CVE-2026-75483

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-75483

powerlevel10k fails to sanitize control characters in the package.json version field when rendering the package prompt segment, allowing an attacker to embed raw escape bytes that emit arbitrary terminal control sequences on each prompt render when a user enters a compromised directory. CVSS 3.1 ...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

CVE-2026-71497

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

UBUNTU-CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

CVE-2026-71497

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain...

Oracle Linux 10 : cups (ELSA-2026-39302)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39302 advisory. 1:2.4.10-18 - RHEL-177945 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly fro...

Oracle Linux 9 : cups (ELSA-2026-39316)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39316 advisory. 1:2.3.3op2-39 - RHEL-177957 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly fr...

PT-2026-58917

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupti...

cups security update

1:2.3.3op2-39 - RHEL-177957 CVE-2026-34980 cups: control character injection in option values...

Oracle Linux 8 : cups (ELSA-2026-36733)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36733 advisory. 1:2.2.6-68 - RHEL-177947 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly from...

cups security update

1:2.2.6-68 - RHEL-177947 CVE-2026-34980 cups: control character injection in option values...

CVE-2026-42459

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm Subscriber Data Management service. An unauthenticated attacker can inject control characters into the SUPI...

CVE-2026-42459

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm Subscriber Data Management service. An unauthenticated attacker can inject control characters into the SUPI...

free5GC 安全漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained security vulnerabilities. These vulnerabilities stemmed from the UDM component failing to validate the supi path parameters of the six GET processors in the nudm-sdm...

Important: Red Hat Security Advisory: python3.14 security update

An update for python3.14 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...