Lucene search
+L

150515 matches found

OSV
OSV
added 2026/07/07 11:40 p.m.10 views

GHSA-V3Q9-HJ7J-63HQ aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Summary aiosmtplib's SMTP.mail, SMTP.rcpt, SMTP.vrfy and SMTP.expn send the caller-supplied email address to the server without rejecting embedded CR/LF \r\n bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the...

6.9CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 11:40 p.m.12 views

CRLF Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to CRLF Injection via the SMTPProtocol.executecommand path in src/aiosmtplib/protocol.py. An attacker can inject extra SMTP verbs by supplying a sender or...

7.5CVSS6.2AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/07/07 11:40 p.m.14 views

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Summary aiosmtplib's SMTP.mail, SMTP.rcpt, SMTP.vrfy and SMTP.expn send the caller-supplied email address to the server without rejecting embedded CR/LF \r\n bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the...

6.1AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/07 11:39 p.m.11 views

GHSA-4HGP-59H5-GVRJ ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

Summary The public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim argument with byte indices arg1..arg.len - 1; if the delimiter character is multibyte...

8.7CVSS5.9AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/07 8:55 p.m.41 views

CVE-2026-46672 Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not...

4.6CVSS0.00132EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/07 8:55 p.m.56 views

CVE-2026-46672

The CVE-2026-46672 entry describes a local CSV formula-injection flaw in the @actual-app/cli before version 26.6.0. The CLI uses a hand-rolled CSV serializer in packages/cli/src/output.ts with an escapeCsv that only neutralizes RFC 4180 delimiters (comma, quote, newline) and does not neutralize c...

4.6CVSS6.1AI score0.00132EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/07 8:16 p.m.16 views

CVE-2026-44454 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a craft...

8.1CVSS6.6AI score
SaveExploits0References9
OSV
OSV
added 2026/07/07 7:36 p.m.14 views

GHSA-FQF6-GXHH-2XHW uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

determinebackupmode in src/uucore/src/lib/features/backupcontrol.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone defaulting to existing/numbered, or $VERSIONCONTROL. Affects cp, install, mv, ln which share th...

7CVSS6AI score
SaveExploits0References3
NVD
NVD
added 2026/07/07 7:16 p.m.18 views

CVE-2026-59800

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

9.8CVSS0.01338EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/07 6:19 p.m.16 views

CVE-2026-59800

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

9.8CVSS6.3AI score0.01338EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/07 6:19 p.m.30 views

CVE-2026-59800 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

9.2CVSS6.3AI score
SaveExploits0References5
EUVD
EUVD
added 2026/07/07 6:19 p.m.14 views

EUVD-2026-42073

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint this route is not covered by the dashboard middleware matcher, so no authorization check is applied. The sudoPassword field from the request body is written to t...

9.8CVSS6.3AI score0.01338EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/07 6:19 p.m.70 views

CVE-2026-59800

The CVE-2026-59800 entry describes an OS command injection in 9Router

9.8CVSS6.3AI score0.01338EPSS
SaveIn wildExploits0References2
Nuclei
Nuclei
added 2026/07/07 4:50 p.m.71 views

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...

9.3CVSS7.4AI score0.99652EPSS
SaveExploits10References5
OSV
OSV
added 2026/07/07 4:41 p.m.8 views

GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus

Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus...

6.2AI score
SaveExploits0References1
OSV
OSV
added 2026/07/07 4:3 p.m.9 views

PYSEC-2026-2053 Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server. Patches https://github.com/WeblateOrg/wlc/pull/1128 Workarounds Do not use wlc download with untrusted servers. References This issue was reported to us by wh1zee via HackerOne...

8CVSS6.1AI score0.00337EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/07 4:3 p.m.9 views

PYSEC-2026-2051 Weblate command-line client susceptible to SSL verification skip

Impact The SSL verification would be skipped for some crafted URLs. Patches https://github.com/WeblateOrg/wlc/pull/1097 Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. References This issue was reported to us by wh1zee via HackerOne...

2.5CVSS6AI score0.00134EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/07 4:3 p.m.13 views

PYSEC-2026-1783 Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Summary Picklescan uses the numpy.f2py.crackfortran.evallength function a NumPy F2PY helper to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.evallength in reduce, allowing arbitrary command...

7.6CVSS6.6AI score0.00523EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/07 4:3 p.m.9 views

PYSEC-2026-1776 pgAdmin 4 has command injection vulnerability on Windows systems

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input...

6.8CVSS6.9AI score0.00841EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 4:3 p.m.9 views

PYSEC-2026-1135 Apache Airflow has a command injection vulnerability in "example_dag_decorator"

An example dag exampledagdecorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production not default or the example dag code copied to build your own...

7.7CVSS6.2AI score0.00459EPSS
SaveExploits0References6
Rows per page
Query Builder