K000163883: JetBrains TeamCity vulnerability CVE-2025-57733

Security Advisory Description In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content CVE-2025-57733 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the...

Security update for the Java stack

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant Updated to version 1.10.18: Security issues fixed: CVE-2021-36374: Fixed excessive memory allocation when readin...

SUSE-SU-2026:4677-1 Security update for the Java stack

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant Updated to version 1.10.18: - Security issues fixed: - CVE-2021-36374: Fixed excessive memory allocation when...

RHLW-2026-C45D2A64E2C0626E Lightwell Security Advisory: android-mail 1.6.7.rhlw-00001

Red Hat Lightwell has released com.sun.mail:android-mail 1.6.7.rhlw-00001 with a backported security fix. CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. This patched...

openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory. - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats bsc1188469. - CVE-2025-7962:...

Security update for ant (important)

openSUSE security update: security update for ant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21891-1 Rating: important References: bsc1188469 bsc1246873 bsc1280015 Cross-References: CVE-2021-36374 CVE-2025-7962 CVE-2026-78254 CVSS scores:...

OPENSUSE-SU-2026:21891-1 Security update for ant

This update for ant fixes the following issues: - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats bsc1188469. - CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection bsc1246873. -...

RHLW-2026-49443DA84312BD4D Lightwell Security Advisory: jakarta.mail 1.6.7.rhlw-00001

Red Hat Lightwell has released com.sun.mail:jakarta.mail 1.6.7.rhlw-00001 with a backported security fix. CVE-2025-7962: In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. This patched...

CVE-2026-82853

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol SMTP commands due to improper sanitization of carriage return and line feed characters in the transport name option. This can lead to email spoofing and phishing attacks...

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

Linux Distros Unpatched Vulnerability : CVE-2026-82854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope...

PT-2026-83731

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the starttls function. An attacker can inject arbitrar...

EUVD-2026-61138

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-45067

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

CVE-2026-45067

The CVE affects Symfony MIME Address: the constructor previously accepted local-parts like "x\r\nBcc: attacker@evil" which could be emitted into message headers and SMTP commands (MAIL FROM/RCPT), enabling CRLF injection. The issue’s root cause is acceptance of line breaks in quoted local-parts; ...

CVE-2026-45067 Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

Security Bulletin: IBM ApplinX is vulnerable to an Improper Neutralization of Input Terminators vulnerability due to the use of Agnus Mail library (CVE-2025-7962)

Summary IBM ApplinX is vulnerable to an Improper Neutralization of Input Terminators vulnerability due to the use of Agnus Mail library CVE-2025-7962. The Agnus Mail library version has been updated within IBM ApplinX in order to address the vulnerabilities. Vulnerability Details...

Supermicro AS-2115HS-TNR BMC security vulnerabilities

Supermicro AS-2115HS-TNR BMC is a server out-of-band management control system developed by Supermicro Corporation. There is a security vulnerability in Supermicro AS-2115HS-TNR BMC, which stems from the injection of custom characters in the SMTP service configuration. This vulnerability may allo...