CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

PT-2026-81035

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.12 CakePHP versions prior to 4.6.5 CakePHP versions prior to 5.1.8 CakePHP versions prior to 5.2.14 CakePHP versions prior to 5.3.7 Description Custom mail headers added via the setHeaders or addHeaders functions ...

CVE-2026-77634: Improper Neutralization of CRLF Sequences

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

PT-2024-40197

Name of the Vulnerable Software and Affected Versions: amphp/http-client affected versions not specified Description: The issue is related to a security weakness that may cause sensitive request headers to leak from the initial request to the redirected host during cross-domain redirects. This...