Login Request a demo
ZI
Product
zip2
by zip-rs · last CVE Oct 26, 2026
6
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 1High 4Medium 1Low 0
Severity
All severities6Critical1High4Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add zip2 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-115909
New
7.5
0%
Oct 26
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
Affected: >= 1.3.0, < 9.0.0
CVE-2026-115907
New
7.5
0%
Oct 26
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
Affected: >= 5.1.0, < 9.0.0
CVE-2026-115908
New
7.4
0%
Oct 26
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)
Affected: >= 7.2.0, < 9.0.0
CVE-2025-29787
7.3
1%
Mar 17
zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write
Affected: >= 1.3.0, < 2.3.0
Showing 4