CVE-2026-1337

CVE-2026-1337 - Neo4j - Inyección de logs Un usuario autenticado puede realizar inyección de logs en el query.log de Neo4j cuando Neo4j no está configurado para usar formato json. Resumen Neo4j no escapa los caracteres de control en el campo de metadatos cuando forma parte de una transacción bolt...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — 简而言之，该漏洞指的是代码的显示形式与其编译后的形式不同（： 攻击利用嵌入在注释和字符串中的控制字符，重新排列源代码的字符，从而改变其逻辑。 例如，假设代码如下： if isAdmin / begin admins only / 通过利用此漏洞，我们可以在编译后将其变成： / if isAdmin begin admins only / 注意：大多数语言都受到影响，其中包括 Rust 版本低于 1.56.0 的 rustc。 好的阅读资源：...

unicode-control-characters-action

Unicode 控制字符 Action 一个用于查找 Unicode 控制字符的 GitHub Action，使用 Red Hat 诊断工具 https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 来检测 RHSB-2021-007 特洛伊木马源代码攻击（CVE-2021-42574、CVE-2021-42694） 输入 args 必需 在 src/README.txt 中记录的脚本参数。 示例用法 name: Tests on: push: branches: - '' jobs: tests: runs-on:...

GHSA-G4QM-M288-5CP9 Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

Astra Linux – Vulnerability in Shadow

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn change finger. Although it is not possible to exploit this directly for example, adding a new user fails because \n is in the block list, it is possible to misrepresent the /etc/passwd file...

Instatic-Stored-XSS-CVE-2026-103931

Omisión del filtro de esquema de URL en isSafeUrl mediante caracteres de control C0 iniciales Afecta a: Instatic v0.0.13 / commit 63ad5d6 y todas las revisiones anteriores que contengan src/core/html-sanitize/index.ts Componente: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Clase: CWE-79...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM versions prior to v0.2.20260929-102736 , the software allows control characters to be embedded in Git subtree URLs . An attacker can exploit this by providing a maliciously constructed repository; if a target clones this repository, it can trigger code execution during otherwise re...

EUVD-2026-91648

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

PT-2026-104338

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026: Improper Neutralization of Escape, Meta, or Control Sequences

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs (ALMALINUX9.2:CLSA-2025:1762867600)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762867600 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of...

AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1767954480)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1767954480 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

AlmaLinux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1767955216)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1767955216 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

Rocky Linux 8 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23481)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523481 advisory. openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61984 openssh: OpenSSH: Null character in ssh:// UR...

AlmaLinux 9.2 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1711476502)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1711476502 advisory. - Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 - Sudo before 1.9.13 does not escape control...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1767627828)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767627828 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...