Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines

Python Software Foundation Security Developer reports: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

MiracleLinux 4 : screen-4.0.3-19.0.1.AXS4 (AXSA:2021-1631:02)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1631:02 advisory. screen: crash when processing combining chars CVE-2021-26937 Tenable has extracted the preceding description block directly from the MiracleLinux security...

PT-2026-3652

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-11468 Description A flaw exists where parenthesis are not preserved when folding a long comment in an email header containing exclusively unfoldable characters. This can allow for the injection of headers into email...

Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines

Python Software Foundation Security Developer reports: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing specific control characters...

MiracleLinux 4 : xterm-253-1.0.1.AXS4 (AXSA:2021-1537:02)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1537:02 advisory. xterm: crash when processing combining characters CVE-2021-27135 CVEs: CVE-2021-27135 Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : xterm-295-3.el7.1 (AXSA:2021-1554:03)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1554:03 advisory. xterm: crash when processing combining characters CVE-2021-27135 Tenable has extracted the preceding description block directly from the MiracleLinux securit...

MiracleLinux 8 : java-11-openjdk-11.0.19.0.7-1.el8 (AXSA:2023-5306:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5306:08 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK:...

MiracleLinux 8 : nodejs:12 (AXSA:2021-2440:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2440:01 advisory. nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22930 nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22940...

CVE-2021-47818

DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in the Excluded text box. Attackers can generate a payload of 8000 repeated characters to trigger the application to stop working on Windows ...

CVE-2021-47827 WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed input. Attackers can trigger the vulnerability by copying a 300-character buffer of repeated 'A' characters into the mashREPL input field,...

CVE-2021-47824

CVE-2021-47824 affects iDailyDiary 4.30. A denial-of-service condition occurs when an attacker pastes a 2,000,000-character buffer into the default diary tab name (preferences tab name). This input overflows the field and crashes the application (local vector in the PoC context). Some sources men...

CVE-2021-47824 iDailyDiary 4.30 - Denial of Service (PoC)

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attackers can paste a 2,000,000 character buffer into the default diary tab name to trigger an application crash...

CVE-2021-47818

CVE-2021-47818 affects DupTerminator 1.4.5639.37199. The issue is a denial-of-service where inputting a long string into the Excluded text box can crash the application on Windows 10; a payload of 8000 repeated characters is cited as triggering the stop. The vulnerable component is the text-input...

CVE-2021-47818 DupTerminator 1.4.5639.37199 - Denial of Service

DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in the Excluded text box. Attackers can generate a payload of 8000 repeated characters to trigger the application to stop working on Windows ...

CVE-2021-47815

Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of 256 repeated characters into the 'Key' field to trigger an application crash...

CVE-2021-47813

Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a large buffer of 256 repeated characters into the registration key field to trigger application instability an...

PT-2026-3275

DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in the Excluded text box. Attackers can generate a payload of 8000 repeated characters to trigger the application to stop working on Windows ...

PT-2026-3280

Name of the Vulnerable Software and Affected Versions iDailyDiary version 4.30 Description The application can be crashed due to a denial of service condition. This occurs when an attacker overflows the preferences tab name field with a large input, specifically a 2,000,000 character buffer. This...

python -- several security vulnerabilities

The Python project announces a new release with several security fixes: CVE-2026-1299: gh-144125: BytesGenerator will now refuse to serialize write headers that are unsafely folded or delimited; see verifygeneratedheaders. Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650. gh-143935:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000979 advisory. The getrockridgefilename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM aka alternate name entries containing \0 characters, which allows...