{"vulnerability": "cve-2026-4638", "sightings": [{"uuid": "72b0c696-46ac-423d-ab9b-dc7dc05d52bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46383", "type": "seen", "source": "https://gist.github.com/alon710/603dfdf0e01af88d7ae6413c9f3332fe", "content": "# CVE-2026-46383: CVE-2026-46383: Arbitrary File Overwrite via Path Traversal (TarSlip) in Microsoft APM\n\n> **CVSS Score:** 5.5\n> **Published:** 2026-05-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46383\n\n## Summary\nA path traversal vulnerability exists in the legacy-bundle probing logic of Microsoft APM, an open-source dependency manager for AI agents. On Windows systems using Python versions prior to 3.12, this allows local attackers to overwrite arbitrary files via a crafted tarball.\n\n## TL;DR\nMicrosoft APM < 0.13.0 on Windows is vulnerable to an arbitrary file overwrite during archive extraction. Exploitation requires user interaction to install a crafted tarball.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-46383\n- **CWE ID**: CWE-22\n- **CVSS Score**: 5.5\n- **Attack Vector**: Local (User Interaction Required)\n- **Impact**: High Integrity (Arbitrary File Overwrite)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- Microsoft APM on Windows environments using Python < 3.12\n- **microsoft/apm**: < 0.13.0 (Fixed in: `0.13.0`)\n\n## Mitigation\n\n- Upgrade the software dependency\n- Upgrade the Python runtime environment\n- Implement strict source validation for installed bundles\n- Enforce least privilege execution\n\n**Remediation Steps:**\n1. Identify all deployments of microsoft/apm currently in use.\n2. Update the package to version 0.13.0 using the appropriate package manager.\n3. Ensure the host system is running Python 3.12 or later to benefit from native extraction filters.\n4. Audit the filesystem for unexpectedly modified files if untrusted bundles were installed prior to patching.\n\n## References\n\n- [GHSA-mq5j-pw29-jcv3](https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46383) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-15T18:40:29.000000Z"}, {"uuid": "ea676a61-82b1-42d2-9573-9e9ccd0b4b2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46387", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c", "content": "\ud83d\udd17 CVE : CVE-2026-45747, CVE-2026-45751, CVE-2026-45752, CVE-2026-45759, CVE-2026-45761, CVE-2026-45762, CVE-2026-45763, CVE-2026-45764, CVE-2026-45765, CVE-2026-45766, CVE-2026-45767, CVE-2026-45768, CVE-2026-45769, CVE-2026-45770, CVE-2026-46352, CVE-2026-46387", "creation_timestamp": "2026-05-20T14:15:33.231991Z"}, {"uuid": "ff1a0e78-c8ce-496c-bfc9-1d22bb2df7ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46384", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-mc57-h6j3-3hmv", "content": "", "creation_timestamp": "2026-05-18T16:22:27.000000Z"}, {"uuid": "a6755183-2b5d-43dc-a1cc-61a521e3065c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46383", "type": "published-proof-of-concept", "source": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "content": "", "creation_timestamp": "2026-05-11T14:08:53.000000Z"}, {"uuid": "e3949f51-68ff-4fba-8de7-f6559405bbae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46380", "type": "published-proof-of-concept", "source": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp", "content": "", "creation_timestamp": "2026-05-27T11:42:06.000000Z"}, {"uuid": "40bf3f2f-b56d-4a88-bcda-3b34c311ff92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46384", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzj6bv5rr27", "content": "CVE-2026-46384 - iskorotkov/avro: Integer Overflow in Avro Decoder\nCVE ID : CVE-2026-46384\n \n Published : May 29, 2026, 8:16 p.m. | 16\u00a0minutes ago\n \n Description : iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-...", "creation_timestamp": "2026-05-29T21:46:54.889718Z"}, {"uuid": "86551205-057f-4058-8808-b980dee238be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46385", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjcgcjw427", "content": "CVE-2026-46385 - iskorotkov/avro: CPU Exhaustion in Avro Decoder\nCVE ID : CVE-2026-46385\n \n Published : May 29, 2026, 8:16 p.m. | 16\u00a0minutes ago\n \n Description : iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-c...", "creation_timestamp": "2026-05-29T21:49:13.811815Z"}, {"uuid": "4adcea00-9043-4d4f-9d65-b77e91011a6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46389", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwkeya5p2k", "content": "\ud83d\udd34 CVE-2026-46389 - Critical (10)\n\nUDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, J...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46389/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-05T20:01:36.034208Z"}, {"uuid": "b96841a3-f548-4657-9d41-1469407b2464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46389", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3moe3jinbbf2e", "content": "\ud83d\udccc CVE-2026-46389 - UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In v... https://www.cyberhub.blog/cves/CVE-2026-46389", "creation_timestamp": "2026-06-15T20:07:07.625653Z"}, {"uuid": "18b3f3ea-1cb2-4bb2-ae2e-ad0c182ab9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46389", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnf3rsl72j", "content": "\ud83d\udea8  ALERT: CVE-2026-46389\n\nCVSS 10.0/10\n\n\ud83d\udccb WHAT IT IS:\nUDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client a", "creation_timestamp": "2026-06-22T00:36:43.227269Z"}, {"uuid": "b82eff53-a50a-48bb-ab12-37b00e32c688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46382", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-46382", "content": "", "creation_timestamp": "2026-08-13T04:15:14.870351Z"}, {"uuid": "cfb5de03-0ee8-4452-9c7d-d15c3e9b7119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46386", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfbyihpui26", "content": "\ud83d\udd34 CVE-2026-46386 - Critical (9.9)\n\nOpenProject is open-source, web-based project management software. Prior to , the official openpr...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-46386/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-29T01:00:46.220361Z"}, {"uuid": "216fbee3-6c30-4e3b-831a-88a0d5ac0abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46388", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd637jh5c2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46388 \u0432 osquery: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/6DC31FEA-115E-4E3F-8BBC-3A46424101F5", "creation_timestamp": "2026-07-10T22:10:32.771120Z"}, {"uuid": "a1f2b2a1-4e4c-4a24-a7ed-e97e9a4a179d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46388", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdcylyadf27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46388 \u0432 osquery: \u0443\u0433\u0440\u043e\u0437\u044b, \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/B399F582-FD6D-4664-AC63-8A968A8DFCD2", "creation_timestamp": "2026-07-10T23:38:33.945951Z"}, {"uuid": "ff94864d-d9ea-42c9-9574-1a6ed863f738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46389", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3229", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 Keycloak \u043f\u0430\u043a\u0435\u0442\u0430 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0439 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 UDS Identity Config \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-07969\nCVE-2026-46389\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw", "creation_timestamp": "2026-07-12T09:01:47.524304Z"}, {"uuid": "600256ad-dbc6-4318-a484-5441bcaa65a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46389", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3mre3eprced2q", "content": "A critical-severity fix just shipped for Defenseunicorns Uds Identity Config. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-46389", "creation_timestamp": "2026-07-24T00:20:02.918815Z"}]}