253025 matches found
xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component
A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...
ROOT-OS-DEBIAN-11-CVE-2026-42959 CVE-2026-42959 in unbound - Patched by Root
Root has patched CVE-2026-42959 in the unbound package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-42960 CVE-2026-42960 in unbound - Patched by Root
Root has patched CVE-2026-42960 in the unbound package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-44690 CVE-2026-44690 in unbound - Patched by Root
Root has patched CVE-2026-44690 in the unbound package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-50252 CVE-2026-50252 in unbound - Patched by Root
Root has patched CVE-2026-50252 in the unbound package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-33278 CVE-2026-33278 in unbound - Patched by Root
Root has patched CVE-2026-33278 in the unbound package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-41292 CVE-2026-41292 in unbound - Patched by Root
Root has patched CVE-2026-41292 in the unbound package for Root:Debian:11. Multiple fixed versions available...
CLSA-2026-1788169795 TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.0.2.post6+tuxcare...
ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root
Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
DEBIAN-CVE-2026-82854
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...
DEBIAN-CVE-2026-82853
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
DEBIAN-CVE-2026-82662
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...
CVE-2026-82665
A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument filepath results in path traversal. The attack...
DEBIAN-CVE-2026-82659
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...
DEBIAN-CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...
DEBIAN-CVE-2026-82660
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...
DEBIAN-CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...
UBUNTU-CVE-2026-82854
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...