ExploitDB-MCP

ExploitDB MCP An MCP server for searching Exploit-DB exploits...

DEBIAN-CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

DEBIAN-CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

DEBIAN-CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

DEBIAN-CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the address parser in src/addressparser/index.ts, where the regex /\s\b^@\s+@^\s+\b\s/ was used to search free text for a...

CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

UBUNTU-CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

UBUNTU-CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100702

A flaw was found in nodemailer. A remote attacker can trigger a Denial of Service DoS by submitting deeply nested arrays in email recipient fields, such as 'to', 'cc', or 'bcc'. When processed, these inputs trigger excessive recursive conversions that exhaust the application's call stack, causing...

EUVD-2026-87675

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702

Versions of Nodemailer before 10.0.2 are vulnerable to a Denial of Service (DoS) due to a flaw in how the library flattens deeply nested arrays in email recipient fields like to , cc , and bcc . A remote attacker can provide a deeply nested JSON recipient array, triggering recursive Array.toStrin...