EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-3153)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the preceding...

CLSA-2026-1777163883 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

CLSA-2026-1773015268 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1772496678 TuxCare security update for trim-newlines (1 CVE)

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 1.0.0-tuxcare.1...

PT-2026-74584

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

PT-2026-73892

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

PT-2026-73829

TuxCare rebuilt trim-newlines to address 1 CVE. Fixed in 1.0.0-tuxcare.1...

CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Summary jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim.indexOf'javascript' === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace/\u0000-\u0020+/g, '' and lowercases the value...

CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

CVE-2026-65636

The CVE-2026-65636 issue affects the ymlr library (Elixir.Ymlr) and its document encoding entry points (Ymlr.document!/2, Ymlr.documents!/2, Ymlr.documents/2). An attacker-controlled comment string is interpolated behind a single #, and CRLF sequences terminate the YAML comment, allowing injectio...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

GHSA-RJWR-M7QX-3FJR oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI summary text is embedded into generated TypeScript MCP server source without proper escaping. oapi-codegen has a similar vulnerability in its server...

PT-2026-59022

Summary aiosmtplib's SMTP.mail, SMTP.rcpt, SMTP.vrfy and SMTP.expn send the caller-supplied email address to the server without rejecting embedded CR/LF r bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the...

BIT-DJANGO-2026-53878 Header injection possibility since DomainNameValidator accepted newlines in input

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names unless used via a form field, since CharField strips newlines. If an application uses values with newlines in an HTTP response, header injection can occur. Djan...

CVE-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier /., and the same construct is produced by the /:params placeholder and the CLI...

CVE-2026-50188

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request, Remote::get, and Remote::post, to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters...