DEBIAN-CVE-2026-116269

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips...

CVE-2026-116269

The MIME::Field::ParamVal component in Perl (specifically within MIME-tools ) versions before 5.521 is vulnerable to an interpretation conflict (CWE-436). When parsing RFC 2231 encoded filenames containing hyphenated language tags (e.g., filename*=utf-8'en-US'payload.exe), the decoder fails to re...

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

CVE-1999-1301

The CVE-1999-1301 issue concerns the rzsz implementation of the Z-Modem protocol in FreeBSD prior to 2.1.5. A design flaw in the Z-Modem handling allows the remote sender of a file to execute arbitrary programs on the client, constituting remote code execution at the client side. Affected compone...