EUVD-2026-90429

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096

AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...

CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47097

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

EUVD-2026-89967

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

CVE-2026-47097 AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

CVE-2026-47097

The AJA HELO Plus firmware (versions before 2.1.7 ) is vulnerable to an information disclosure vulnerability. The root cause is a static AES passphrase embedded in an obfuscated form within the firmware, which can be recovered via reverse engineering of the publicly available firmware image. Unau...

CVE-2026-47097 AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

CVE-2026-47097: Use of Hard-coded Cryptographic Key

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

SUSE CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

UBUNTU-CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

EUVD-2026-68441

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

Linux Distros Unpatched Vulnerability : CVE-2026-82853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is...

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

Summary Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport name configuration option. The name value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters \r\n. A...