24307 matches found
CVE-2026-43968
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...
CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...
CVE-2026-43968
CVE-2026-43968 involves an CRLF injection in ninenines/cowlib, triggered by the SSE encoding path cow_sse:event/1. The root cause is improper neutralization of CRLF sequences: while id and event fields guard against \n, bare \r is not sanitized, and prefix_lines/2 used for data and comment fields...
CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...
CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...
EEF-CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow\sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix\lines/2...
CVE-2026-42612
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting XSS vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss function when handling unquoted HTML event attribute...
Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest
Summary Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest...
GHSA-PWFH-MQP3-PQWJ Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest
Summary Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest...
CVE-2026-42612 Grav: Publisher-Level Stored XSS via Unquoted Event Attributes
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting XSS vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss function when handling unquoted HTML event attribute...
CVE-2026-42612
Grav: Publisher-level stored XSS in getgrav/grav due to a flawed blacklist in detectXss() that mishandles unquoted HTML event attributes. This allows arbitrary JavaScript execution via crafted content prior to 2.0.0-beta.2. The issue is fixed in Grav core on the 2.0 branch; upgrade to 2.0.0-beta....
CVE-2026-34091 User localization leaked by AbuseFilter + EventStream
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...
CVE-2026-8270
creationtimestamp| type| source ---|---|--- 2026-05-11 07:26:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkqopo57u2i...
CVE-2026-8269
creationtimestamp| type| source ---|---|--- 2026-05-11 07:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlkqfraxn62p...
PT-2026-39726
Name of the Vulnerable Software and Affected Versions cowlib versions 2.6.0 and later Description Improper Neutralization of CRLF Sequences CRLF Injection allows SSE event splitting and injection through unvalidated field values. The cow sse:event/1 function guards the id and event fields against...
CVE-2021-47936
creationtimestamp| type| source ---|---|--- 2026-05-10 16:34:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlj6teveoq2k...
CVE-2022-50957
creationtimestamp| type| source ---|---|--- 2026-05-10 14:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mliyqyf3sj2k...
CVE-2021-47910
AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon title' field. Attackers can store XSS payloads like image tags with onerror event handlers that execut...
CVE-2026-8241
A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the component RMI Interface. Such manipulation leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed ...