TChopper

TChopper New technique I have discovered recently and give it a nickname Chop chop to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool. image How it works the tool will get the...

CVE-2026-114726

Fix mail header injection via the From display-name in the Bounce resend action...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability within the Bounce (resend) action. The root cause is that the rcube_mime::decode_address_list() function fails to strip control characters from decoded display names. This allow...

EUVD-2026-107703

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcubemime::decodeaddresslist did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequence...

PT-2026-120961

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce resend action. rcube mime::decode address list did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF...

CLSA-2026-1792162145 TuxCare security update for @babel/plugin-transform-react-display-name (1 CVE)

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792162144 TuxCare security update for @babel/plugin-transform-react-display-name (1 CVE)

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792162142 TuxCare security update for @babel/plugin-transform-react-display-name (1 CVE)

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792162141 TuxCare security update for @babel/plugin-transform-react-display-name (1 CVE)

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-115542

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1 Description The Tutor LMS plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or...

PT-2026-115449

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

PT-2026-115528

Name of the Vulnerable Software and Affected Versions SureDash versions prior to 1.12.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into...

Astra Linux - Vulnerability in Golang-1.19

The ParseAddressList function improperly handles comments text within parentheses within display names. Since this contradicts conforming address parsers, it can lead to different trust decisions being made by programs that use different parsers...

VulnCheck KEV: CVE-2024-2347

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

CVE-2026-96564

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91905

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...