EUVD-2026-102501

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import t...

Linux Distros Unpatched Vulnerability : CVE-2026-110757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Text::CSVXS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check...

PT-2026-115856

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

PT-2026-116173

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description The parse function incorrectly handles input that ends with a separator followed by a lone carriage return CR. In such cases, the parser treats the end of the input as the subsequent character an...

Red Hat: CVE-2026-110754: perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via memory leak during malformed CSV parsing

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

PT-2026-116166

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where memory exhaustion can occur due to the allocation of one entry per index of an RFC 7111 selector within the fragment function. The fragment function expands row= or col=...

PT-2026-116167

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions 1.46 through 1.64 Description A use-after-free issue exists when skip empty rows skips an empty line in the getline function. When using bind columns, the parser writes fields into the caller's scalar without taking a...

PT-2026-116168

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where the getline function fails to free the array or the fields parsed before a syntax error occurs. While the function normally returns a reference to the record array upon...

PT-2026-116169

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description Processing CSV input with carriage return CR only line endings using the getline function can lead to quadratic CPU usage. When the eol variable is unset, the parser treats CR-only input as a...

PT-2026-116171

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists where record splitting can occur when writing strings used as numbers without quotes in the combine function. The combine and print functions fail to verify if a field requires...

PT-2026-116172

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists in the strip trail whitespace function when allow whitespace is enabled. The function removes trailing spaces and tabs from unquoted fields but fails to stop at the start of the...

PT-2026-116170

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists in the print function where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes. During buffer flushes, the system holds ba...

CVE-2026-111358

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import t...

CVE-2026-111358 SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import t...

CVE-2026-111358 SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import t...

CVE-2026-111358

SendPortal sendportal-core versions through 4.0.1 are vulnerable to an authorization bypass (CWE-639) caused by the use of unvalidated tag IDs. This flaw allows authenticated workspace members to attach subscribers to tags belonging to other workspaces. Attackers can exploit this by submitting se...

CVE-2026-55154

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2026-55154 EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-55154

The open source CRM application EspoCRM is vulnerable to CSV/Formula Injection in versions prior to 9.3.9 . The root cause is a sanitizer bypass in sanitizeCellValue() within Processor.php files for CSV and XLSX formats, which only inspect the first byte. An authenticated low-privileged user can ...