https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T00:16:47.709092+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41082 CVE-2026-41082 2026-10-07T00:16:48.900869+00:00

Affected: OCaml opam, Red Hat Enterprise Linux 10

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

 https://vulnerability.circl.lu/vuln/usn-8256-1 USN-8256-1 — opam vulnerability 2026-10-07T00:16:48.901029+00:00

Affected: Ubuntu:Pro:20.04:LTS: opam, Ubuntu:22.04:LTS: opam, Ubuntu:Pro:24.04:LTS: opam, Ubuntu:25.10: opam, Ubuntu:Pro:26.04:LTS: opam

Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution.