Linux Distros Unpatched Vulnerability : CVE-2026-93576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name...

CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

UBUNTU-CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

EUVD-2026-82976

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93576 Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93576 Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93576

CVE-2026-93576 affects Netty netty-codec-smtp , where the SMTP command-name field is not properly CRLF-validated . This is classified as an incomplete fix of the earlier CVE-2025-59419 , meaning the previous remediation did not fully address the validation gap. The Red Hat-assigned CVSS 3.1 score...

CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

Malicious code in @bonsai-ai/claude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9 Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets author to 'Anthropic '...

EUVD-2025-206496

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...

CVE-2025-59896

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...

CVE-2025-59896 Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...

CVE-2025-59896 Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...

CVE-2025-59893

CVE-2025-59893 is a CSRF vulnerability affecting Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated attacker could induce another user to perform unwanted actions due to missing CSRF token protection. The description notes a specific vector: a POST request...

Improper Access Control

commandkit is vulnerable to an improper access control.The vulnerability is due to a logic flaw in how ctx.commandName is populated for message-based command aliases, which allows an attacker to exploit incorrect permission checks or access-control logic when developers mistakenly treat the alias...

CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...

CVE-2025-62378 CommandKit exposes incorrect command name in context object for message command aliases

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...

CVE-2025-62378

CommandKit (Discord.js meta-framework) versions 1.2.0-rc.1 through 1.2.0-rc.11 expose ctx.commandName as the alias used to invoke a message command, rather than the canonical command name. This affects both middleware and the command’s own run context, enabling potential misapplication of permiss...

CVE-2025-62378 CommandKit exposes incorrect command name in context object for message command aliases

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...