437 matches found
CVE-2026-41507
CVE-2026-41507 affects math-codegen. Prior to 0.4.3, string literals passed to cg.parse() are injected into a new Function() body without sanitization, enabling attacker-controlled input to execute arbitrary system commands and potentially achieve full RCE when user input reaches the parser. The ...
CVE-2026-23927 Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session...
CVE-2026-6539
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
CVE-2026-6539 Notepad++ 8.9.3 Format String Injection via nativeLang.xml
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
CVE-2026-6539
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
CVE-2026-6539
Notepad++ 8.9.3 is affected by a vulnerability described as a format string injection in the Find Results panel handler, triggered by a malicious nativeLang.xml language pack. The issue can be introduced by poisoned language packs distributed via community channels and triggers format string inte...
CVE-2026-6539 Notepad++ 8.9.3 Format String Injection via nativeLang.xml
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
CVE-2026-6539: Use of Externally-Controlled Format String
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through...
PT-2026-36185
Name of the Vulnerable Software and Affected Versions Notepad++ version 8.9.3 Description A format string injection exists in the Find Results panel handler. This occurs when the application processes a maliciously crafted nativeLang.xml language pack file. An attacker can distribute a poisoned...
Notepad++ formatting string error vulnerability
Notepad++ is an open-source plain-text editor developed by Don Ho of Taiwan, China. Version 8.9.3 of Notepad++ has a vulnerability related to format strings. This vulnerability stems from format string injection in the Find Results panel’s processing logic, which may lead to denial-of-service...
CVE-2026-3008
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application...
EUVD-2026-25775
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application...
CVE-2026-3008 Vulnerability in Notepad++
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application...
CVE-2026-3008
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application...
CVE-2026-3008
CVE-2026-3008 is a Notepad++ string-injection vulnerability in the Find Results flow. A vulnerability in sub_1400916C0 formats the Find Results count label using a localized string from nativeLang.xml as the wsprintfW format string, with no validation of the string flow. This can cause a crash (D...
CVE-2026-3008 Vulnerability in Notepad++
Successful exploitation of the string injection vulnerability could allow an attacker to obtain memory address information or crash the application...
PT-2026-35357
Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.4 Description A string injection issue exists in the FindInFiles function of the text editor, stemming from flaws in the formatting string processing mechanism. Successful exploitation could allow an attacker to...
Notepad++ formatting string error vulnerability
Notepad++ is an open-source plain-text editor developed by Don Ho of Taiwan, China. Notepad++ has a vulnerability related to formatted string handling, which stems from string injection issues. This vulnerability may allow attackers to obtain memory address information or cause the application to...
PT-2026-36659
Summary Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of...
