PT-2026-85745

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...

Important: criu

Issue Overview: A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials sav...

openSUSE 16 Security Update : broot (openSUSE-SU-2026:21675-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21675-1 advisory. Changes in broot: - v1.59.0 CVE-2026-72847 boo1275994 new shellcommand verb attribute: run a command through a shell sh -c / cmd /C so &&, ; and pipes...

Security update for broot (moderate)

openSUSE security update: security update for broot ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21675-1 Rating: moderate References: bsc1275994 Cross-References: CVE-2026-72847 CVSS scores: CVE-2026-72847 SUSE : 4.6...

OPENSUSE-SU-2026:21675-1 Security update for broot

This update for broot fixes the following issues: Changes in broot: - v1.59.0 CVE-2026-72847 boo1275994 new shellcommand verb attribute: run a command through a shell sh -c / cmd /C so &&, ; and pipes work, without leaving broot - Fix 1145 fix invalid official Mac binary duplicate linked dylib wi...

CVE-2026-33606: Improper Neutralization of CRLF Sequences

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

PYSEC-2026-3775

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

PYSEC-2026-3775

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81695

openssl_encrypt versions before 1.4.9 are affected by a terminal injection vulnerability. During decrypt auto-detection, attacker-controlled key_id values are printed to stderr without proper escaping, allowing an attacker to craft encrypted files containing escape sequences that repaint terminal...

EUVD-2026-67052

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81696

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata output by the info command. An attacker can craft malicious files containing escape sequences that repaint terminal output and forge verification information displayed to users. The fix is availabl...

CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

EUVD-2026-66399

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances...

NitroShare Desktop 0.3.4 Path Traversal

NitroShare Desktop version 0.3.4 contains a path traversal vulnerability in its LAN file transfer receive path. The transfer service is reachable from the local network on TCP port 40818 and processes incoming transfer metadata without authentication in the reported default configuration. A...

CVE-2026-47890: Improper Neutralization of CRLF Sequences

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-81707: Improper Input Validation

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-59313: Improper Neutralization of CRLF Sequences

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...