7168 matches found
PYSEC-2026-3775
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
PYSEC-2026-3793
opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...
CVE-2026-56652
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...
CVE-2026-81696
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
EUVD-2026-67050
openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...
CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata
opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...
EUVD-2026-67128
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...
CVE-2026-56652
Dool (versions up to 1.3.8 ) is affected by a CSV injection vulnerability in its CSV export functionality. The tool fails to sanitize cell content beginning with special formula characters (=, +, -, or @), allowing a local attacker to craft a process name starting with one of these characters, th...
CVE-2026-56652 Formula Injection in dool project
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...
CVE-2026-56652 Formula Injection in dool project
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting wit...
CVE-2026-54770
A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users...
PT-2026-85188
openssl encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing...
PT-2026-82540
Name of the Vulnerable Software and Affected Versions Dool versions prior to 1.3.9 Description The software is susceptible to CSV injection during the data export process to CSV files. This occurs because the application fails to sanitize cell content that begins with special formula characters...
CVE-2026-81696: Improper Output Neutralization for Logs
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
PT-2026-82736
Name of the Vulnerable Software and Affected Versions MongoDB C++ Driver affected versions not specified Description A weakness in the handling of caller-supplied namespace identifiers allows the embedding of special characters. If an application constructs a namespace identifier using untrusted...
PT-2026-82597
openssl encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
TencentOS Server 3: sg3_utils (TSSA-2026:0906)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0906 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
GHSA-8H6H-X5PQ-56FQ @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...