317690 matches found
EUVD-2026-68442
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...
CVE-2026-82854
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...
EUVD-2026-68441
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2026-82853
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2026-82853
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed (CRLF) characters, enabling attackers with elev...
CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...
CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...
CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...
EUVD-2024-55736
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...
CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...
CVE-2024-58379
nodemailer before 6.9.9 contains a regular expression denial of service (ReDoS) vulnerability in email parsing, triggered when the attachDataUrls parameter is set or when processing embedded file attachments. Attackers can send specially crafted emails containing malicious data URLs or embedded a...
CVE-2024-58379
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...
K000163144: Spring Data vulnerability CVE-2026-41696
Security Advisory Description Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected...
CyberLabs-SOC-L1-RetailBreach
🛡️ CyberLabs SOC L1 – RetailBreach Investigation Overview...
K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936
Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...
Exploit for CVE-2026-76569
Reflected XSS via search GET Parameter in Phoca Download Ph...
CVE-2026-80694
A flaw was found in the Linux kernel's mtkethsoc Ethernet driver. The mtkpollcontroller function incorrectly passed a netdevice pointer instead of an mtketh structure to mtkhandleirqrx. This incorrect parameter passing can lead to a system crash when ndopollcontroller is called with...
