224 matches found
CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-64941: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-5078
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...
CVE-2026-5078: Improper Output Neutralization for Logs
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...
AZL-82899 CVE-2026-1502 affecting package python3 for versions less than 3.12.9-11
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
PT-2026-83730
Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.5 Description An SMTP command injection issue exists in the transport name configuration option used in EHLO, HELO, and LHLO commands. The name parameter is concatenated directly into SMTP commands without...
[slackware-security] gvfs
New gvfs packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/gvfs-1.48.1-i586-2slack15.0.txz: Rebuilt. This update fixes security issues: ftp: Use control connection address for PASV data. ftp:...
GO-2026-4422 EVE Freely Allocates Buffer on The Stack With Data From Socket in github.com/lf-edge/eve
EVE Freely Allocates Buffer on The Stack With Data From Socket in github.com/lf-edge/eve...
GO-2026-4432 EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve
EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve...
CVE-2023-4522
An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit...
EUVD-2020-7680
Malware in sbrugna...
EUVD-2024-54482
Malicious code in bioql PyPI...
EUVD-2024-22912
Malicious code in bioql PyPI...
EulerOS 2.0 SP9 : golang (EulerOS-SA-2025-2125)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a...
Linux Distros Unpatched Vulnerability : CVE-2025-58056
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions...
UBUNTU-CVE-2025-58056
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters LF as a chunk-size line...
CVE-2025-58056: Inconsistent Interpretation of HTTP Requests
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters LF as a chunk-size line...
MAL-2025-28210 Malicious code in omega-cms-lf-ng-md-file-input (npm)
The package omega-cms-lf-ng-md-file-input was found to contain malicious code...
