decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

CVE-2026-100559

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...

CVE-2026-100559 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...

EUVD-2026-87491

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090455 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirec...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

User-controlled header names and values containing newlines can allow for the injection of HTTP headers...

Astra Linux – Vulnerability found in Python 3.11, Python 2.7, and Python 3.7

There is a medium-severity vulnerability affecting CPython. The email module does not properly quote newlines for email headers when serializing an email message, allowing for header injection when an email is serialized...

CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-73319 XenForo < 2.3.13 XSS via Dynamic Redirect Handler

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-85656

CVE-2026-85656 is an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package in Amazon Linux versions before 1.3-9 . A local user with low privileges can execute arbitrary commands with root privileges by leveraging embedded newline characters in a Java process's executabl...

CVE-2026-44244

A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55216

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55244

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-3153)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the preceding...

CLSA-2026-1777163883 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

CLSA-2026-1773015268 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1772496678 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 1.0.0-tuxcare.1...

CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...