734 matches found
EUVD-2026-28446
Improper neutralization of special elements in output used by a downstream component 'injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-26164
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-26164
Improper neutralization of special elements in output used by a downstream component 'injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
Microsoft 365 Copilot BizChat 注入漏洞
Microsoft 365 Copilot BizChat is an AI chat software developed by Microsoft Corporation. There is a vulnerability in Microsoft 365 Copilot BizChat, which stems from improper neutralization of special elements in the output of downstream components. This vulnerability could allow unauthorized...
CVE-2026-43081
In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERICCMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI GSIV30EEnGSIEEGENERICCMD. Notably this fixes a WARN I was seeing when I tried to send "stop...
PT-2026-37391
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net: ipa component where GENERIC CMD register field masks for IPA v5.0+ do not match the hardware layout documented in downstream GSI. This can lead to a warning...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview org.webjars.npm:mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the...
Header Injection
Apache Camel is vulnerable to Header Injection. The vulnerability is due to missing inbound header filtering in the MailHeaderFilterStrategy, which allows an attacker to inject malicious Camel-specific headers via email and manipulate downstream component behavior...
Remote Code Execution (RCE)
Apache Camel is vulnerable to Remote Code Execution. The vulnerability is due to inconsistent case-sensitive header filtering in non-HTTP HeaderFilterStrategy implementations, which allows an attacker to inject malicious headers that are later interpreted by downstream components to execute...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the gettokenizer function in the...
CVE-2026-39807
The CVE describes a vulnerability in Bandit (Elixir) where the function Elixir.Bandit.Pipeline:determine_scheme/2 returns the client-supplied URI scheme verbatim, ignoring the transport’s secure flag. On plaintext TCP, a client can declare https and Bandit will set conn.scheme = :https even witho...
PT-2026-35384
Name of the Vulnerable Software and Affected Versions Camel-Mail affected versions not specified Description An issue exists in the Camel-Mail component where a missing inbound filter allows for message header injection. An attacker can send a specially crafted email to a mailbox monitored by a...
Heimdall has an authorization bypass via path normalization mismatch
Summary Heimdall performs rule matching on the raw non-normalized request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path e.g., /user/../admin, or URL-encoded variants...
Official Clerk JavaScript SDKs 安全漏洞
The Official Clerk JavaScript SDKs are an open-source repository for Clerk authentication purposes. These SDKs contain security vulnerabilities; one of them allows for specially crafted requests to bypass the middleware gateways, resulting in access to downstream processing routines...
CVE-2026-27843
SenseLive X3050 is affected by CVE-2026-27843, where the web management interface permits modification of critical configuration parameters without sufficient authentication or server-side validation. By feeding unsupported or disruptive values to recovery mechanisms and network settings, an atta...
PT-2026-34802
A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can...
CVE-2026-35343
The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...
CVE-2026-35343
The issue (CVE-2026-35343) affects the uutils coreutils cut utility. When using -s with a newline delimiter, the code path in cut_fields_newline_char_delim does not verify the only_delimited flag, causing non-delimited lines to be emitted instead of suppressed. This is documented as a vulnerabili...
CVE-2026-35343 uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters
The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation fails to verify the onlydelimited flag in the cutfieldsnewlinechardelim function, causing the utility to print non-delimited lines that...