EUVD-2026-69220

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path...

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

Summary An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should reject a malformed qualified name with InvalidCharacterError, but a name whose first line is well-form...

GHSA-VR34-HP96-76PP xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

EUVD-2026-70242

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service...

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

CVE-2026-78635 Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

EUVD-2026-74179

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

GHSA-284H-M62Q-GF8W GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

CWE: CWE-88 Argument Injection / CWE-94 Code Injection — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument - Affected component: git/config.py — GitConfigParser.read multi-line value decoding, lines 444-541, esp. stringdecode at line 460 and its call sites at...

EUVD-2026-65222

GitPython: Dormant multi-line git-config values are corrupted into live injected directives e.g. core.hooksPath on any unrelated GitConfigParser write, enabling RCE...

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

CWE: CWE-88 Argument Injection / CWE-94 Code Injection — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument - Affected component: git/config.py — GitConfigParser.read multi-line value decoding, lines 444-541, esp. stringdecode at line 460 and its call sites at...

CVE-2026-78635: Improper Neutralization of Argument Delimiters in a Command

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

NewStart CGSL MAIN 7.02 : librabbitmq Vulnerability (NS-SA-2026-0102)

The remote NewStart CGSL host, running version MAIN 7.02, has librabbitmq packages installed that are affected by a vulnerability: - An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for...

radare2 v6.2.2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.4, next release will be 6.2.5. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...

UBUNTU-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

The vulnerability of the Util-linux command-line utility suite relates to deficiencies in handling error situations, allowing attackers to exploit their privileges.

The vulnerability of the Util-linux command-line utility package is related to deficiencies in handling error situations. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the command-line interface of data storage software Infinispan allows attackers to exploit it to disclose sensitive information.

The vulnerability of the command-line interface of data storage software called Infinispan is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...

CVE-2026-19862

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

PT-2026-86505

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...