48295 matches found
CVE-2026-64607
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...
CVE-2026-49853
A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...
CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
UBUNTU-CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
EUVD-2026-68439
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize CRLF (carriage return/line feed) characters in list.*.comment fields, enabling attackers who control these parameters to inject arbitrary message headers into generated RFC 822 messages. This can alter mail client behavior and message semantics . The vuln...
CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
[SECURITY] [DLA 4762-1] libarchive security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4762-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 31, 2026 https://wiki.debian.org/LTS -...
Exploit for Incomplete Filtering of Special Elements in Axis Axis_Os
CVE-2025-0324 — Root Cause Analysis A client-controlled Ho...
CVE-2026-82726
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
CVE-2026-63621
A flaw was found in Apache Camel Knative component. The Knative consumer in camel-knative improperly handles CloudEvent extension fields in structured content mode, copying them directly into message headers without proper filtering. This allows an unauthenticated attacker to inject internal Came...
CVE-2026-82726
CVE-2026-82726 is a permissive regular expression vulnerability in ash-project ash_phoenix (versions 2.1.26 through before 2.3.25). The function AshPhoenix.Helpers.get_subdomain/2 interpolated the root host raw into a regex, turning each dot into a wildcard and allowing metacharacters as pattern ...
CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...
CVE-2026-82726
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...
EUVD-2026-68335
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...
CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...