Login Request a demo
ZI
Product
zip2
by zip-rs · last CVE Oct 26, 2026
5
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 1High 3Medium 1Low 0
Severity
All severities5Critical1High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add zip2 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-115905
New
10.0
0%
Oct 26
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Affected: < 9.0.5
CVE-2026-115909
New
7.5
0%
Oct 26
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
Affected: >= 1.3.0, < 9.0.0
CVE-2026-115907
New
7.5
0%
Oct 26
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
Affected: >= 5.1.0, < 9.0.0
CVE-2026-115908
New
7.4
0%
Oct 26
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
Affected: >= 7.2.0, < 9.0.0
CVE-2026-115906
New
6.5
0%
Oct 26
zip: AES Entry HMAC Authentication Bypass on Premature EOF
Affected: >= 0.6.0, < 9.0.0
Showing 5