13433 matches found
The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.
The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
CVE-2026-49130
MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...
EUVD-2026-32664
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...
CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...
GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
GHSA-QPMX-3RFJ-7RHV Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
CVE-2026-45088
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...
CVE-2026-44345
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...
CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...
CVE-2026-39828 vulnerabilities
Vulnerabilities for packages: helm, k9s, flux-source-controller, cilium, kaf, zarf, flux, spire-server, chisel, kubernetes, telegraf, kine, kyverno, trivy-operator, loki, nerdctl, osv-scanner, prometheus, cilium-cli, snyk-cli, cloud-provider-aws, kubernetes-dashboard, minio,...
CVE-2026-46598 vulnerabilities
Vulnerabilities for packages: helm, cilium, kaf, flux, spire-server, kubernetes, telegraf, kine, kyverno, loki, nerdctl, prometheus, cilium-cli, snyk-cli, cloud-provider-aws, kubernetes-dashboard, minio, fscrypt, external-dns, gitlab-kas, k3s, kots, prometheus-operator, rancher, cert-manager,...
CVE-2026-39834 vulnerabilities
Vulnerabilities for packages: flux-source-controller, vault-benchmark, src, zarf, pulumi-language-dotnet, chisel, cosign, dagger, kubernetes, witness, trivy-operator, flux-kustomize-controller, crossplane-provider-azure-managedidentity, gomplate, rancher-machine, step, hcloud, buildkitd,...
WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Line Agency versions = 1.3.1...
CVE-2026-46595 vulnerabilities
Vulnerabilities for packages: argo-workflows, kaf, rancher, kubernetes, drone, istio, argo-workflows-fips, knative-serving, cert-manager, prometheus-operator, external-dns, k9s-fips, omnictl-multiarch, kubevela-fips, kubernetes-dashboard, kubescape-server, kubescape-server-fips, k9s, skaffold,...
CVE-2026-39832 vulnerabilities
Vulnerabilities for packages: argo-workflows, kaf, rancher, kubernetes, istio, argo-workflows-fips, knative-serving, cert-manager, prometheus-operator, external-dns, syft, guac, pulumi-language-java, k9s-fips, grype-fips, omnictl-multiarch, kubevela-fips, consul, chezmoi, kubernetes-dashboard, ac...
USN-8321-1: Papers vulnerability
It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code...
CVE-2026-45842
A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol and PPP Point-to-Point Protocol components. An unprivileged local user can exploit this vulnerability by manipulating the PPPIOCSMAXCID ioctl to configure the SLIP Compressed Header SLHC state incorrectly. This...
CVE-2026-45843
A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP implementation. The slhcuncompress function, which handles VJ-compressed TCP headers, fails to perform proper bounds checks during packet processing. A remote attacker could exploit this by sending a specially crafted...
