CVE-2026-97233

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-61815

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815

The zbateson/mail-mime-parser library is vulnerable to CRLF header injection (CWE-93) in versions prior to 3.0.6 and 4.0.2 . The root cause is the interpolation of attacker-influenced attachment filenames into Content-Type and Content-Disposition headers without stripping CR/LF characters. This a...

EUVD-2026-86335

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

EUVD-2026-86321

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-97233 volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

EUVD-2026-85879

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97359

HFS2 version 2.4.0 and earlier are vulnerable to a template injection flaw within the multipart upload handler . Unauthenticated attackers can achieve remote code execution (RCE) on the underlying host system by crafting a filename containing a closing template quoting sequence followed by an exe...

CVE-2026-97233: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-97359: Improper Neutralization of Special Elements Used in a Template Engine

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

PT-2026-98207

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.12 Description Cross site scripting occurs in the Media Filename Handler component due to improper handling of the file path argument within the html function of the PlaylistManager.js file. This allow...

CVE-2026-61815: Improper Neutralization of CRLF Sequences

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

GHSA-8PCW-H6W9-H46G plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

Impact When creating an Image or File with a very large filename, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.contenttypes. On Plone 6.2, upgrade to plone.app.contenttypes...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

PT-2026-97665

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

Debian dla-4785 : zip - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4785 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/...