BIT-MYSQL-CLIENT-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

BIT-MARIADB-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-92262

The MariaDB server is vulnerable to multiple issues caused by a historical #mysql50# tablename encoding bypass . The root cause allows the #mysql50# prefix to bypass normal filesystem encoding for table names. An attacker can trigger this by using a table name with the #mysql50# prefix to access ...

CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

PYSEC-2026-4025 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

PT-2026-57362

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The load data method strips only NUL bytes from a PDF-controlled CMap name, then...

CVE-2026-45409

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

USN-8416-1: Go Networking vulnerability

It was discovered that Go Networking incorrectly handled certain Punycode-encoded labels in the idna package. An attacker could possibly use this issue to bypass hostname-based access restrictions...

DEBIAN-CVE-2026-45409

Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto function pri...

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto function prior to length rejection, and for high values of N will take a long time to process. Impact A speciall...

GHSA-CM33-6792-R9FM Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty Encoder + Decoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-dns | | Component | io.netty.handler.codec.dns.DnsCodecUtil | |...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper HTML encoding of page names in search results. An attacker can execute arbitrary JavaScript in the context of users viewing the affected search results by injecting malicious scripts through the pag...

CVE-2020-37167

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious...

CVE-2020-37167 ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious...

EUVD-2019-0685

Malware in sbrugna...

python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()

A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode function can trigger an uncontrolled resource consumption, resulting in a denial of service...