CVE-2022-33993

Misinterpretation of special domain name characters in DNRD aka Domain Name Relay Daemon 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

CVE-2022-33990

Misinterpretation of special domain name characters in dproxy-nexgen aka dproxy nexgen leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

CLSA-2026-1767954480 openssh: Fix of 2 CVEs

CVE-2025-61984: fix username handling by rejecting control characters from untrusted sources to prevent ProxyCommand code execution - CVE-2025-61985: disallowed NUL characters in ssh:// URI parsing to prevent ProxyCommand-based code execution...

CVE-2023-25160

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for...

CVE-2026-0707 Keycloak: keycloak authorization header parsing leading to potential security control bypass

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters such as tabs as separators and tolerates case variations that deviate from RFC 6750 specifications...

Keycloak 安全漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak has a security vulnerability that stems from the fact that the Authorization header parser is too loose with the format of the Bearer authentication scheme, which could lead to non-standard...

PT-2026-1792

Name of the Vulnerable Software and Affected Versions AmentoTech Workreap theme's plugin versions through 3.3.6 Description The Workreap plugin contains a flaw related to improper handling of special characters within SQL queries, potentially allowing for SQL Injection. This could allow an attack...

CVE-2026-21439

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line...

CVE-1999-0275

Denial of service in Windows NT DNS servers by flooding port 53 with too many characters...

CVE-2019-16772

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

CVE-2019-16294

SciLexer.dll in Scintilla in Notepad++ x64 before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file...

CVE-2019-12043

In remarkable 1.7.1, lib/parserinline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL...

badkeys 安全漏洞

badkeys is an open source library of tools from badkeys to check cryptographic public keys for vulnerabilities. A security vulnerability exists in badkeys version 0.0.15 and earlier, which stems from the fact that an attacker can inject content containing ASCII control characters, potentially...

CVE-2026-21439 badkeys vulnerable to ASCII control character injection on console via malformed input

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line...

CVE-2026-21439

CVE-2026-21439 affects the badkeys tool/library, where versions ≤0.0.15 allow ASCII control characters (e.g., vertical tabs, ANSI escape sequences) to inject misleading output in DKIM scanning (--dkim/--dkim-dns), SSH lines (--ssh-lines), and related filenames. The issue is fixed in version 0.0.1...

CVE-2026-21439 badkeys vulnerable to ASCII control character injection on console via malformed input

badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., that can create misleading output of the badkeys command-line...

CVE-2025-69225

CVE-2025-69225 affects the aiohttp project (versions 3.13.2 and below) where the Range header parser incorrectly allows non-ASCII decimals. The description notes no known impact but discloses a potential method for exploiting a request smuggling vulnerability; remediation is to upgrade to 3.13.3....

DEBIAN-CVE-2025-69224

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...

CVE-2025-69224

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...

CVE-2025-69224

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed i.e. without the usual C extensions ...