49731 matches found
PT-2026-81476
Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The noparenthesis function in eml parser/routing.py uses a regex-based fix-point loop to remove parenthesized CFWS Comments and Folding White Space from Received: headers. The processing time for...
EulerOS Virtualization 2.13.1 : python-urllib3 (EulerOS-SA-2026-3194)
According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...
EulerOS Virtualization 2.13.0 : python3 (EulerOS-SA-2026-3235)
According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted t...
RHCOS 4 : OpenShift Container Platform 4.21.30 (RHSA-2026:57456)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57456 advisory. - mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 Note that Nessus has not tested for this...
EulerOS Virtualization 2.13.0 : python-urllib3 (EulerOS-SA-2026-3234)
According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...
EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-3195)
According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted t...
JetBrains TeamCity < 2021.1.3 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. CVE-2021-43201 - In JetBrains TeamCity...
CRLF Injection
Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to CRLF Injection via the setHeaders or addHeaders functions. An attacker can inje...
CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
DEBIAN-CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
External Control of Assumed-Immutable Web Parameter
Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the process that maps CloudEvent extension fields onto message headers without applying any header filter strategy in structured content...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation due to improper validation of HTTP headers in the headerFilterStrategy process. An attacker can manipulate HTTP headers to inject unauthorized directives or bypass intended header filtering by sending specially...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview org.apache.camel:camel-mail is a Camel Mail support. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the unmarshal process when headersInline is enabled. An attacker can manipulate...
CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
CVE-2026-77634
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...
