13513 matches found
The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.
The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
CVE-2026-49130
MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...
EUVD-2026-32664
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...
CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh
claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...
GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...
GHSA-QPMX-3RFJ-7RHV Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
CVE-2026-45088
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...
CVE-2026-44345
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...
CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...
CVE-2026-39828 vulnerabilities
Vulnerabilities for packages: spire-server, kubernetes, argocd-image-updater, zarf, flux-source-controller, opentelemetry-collector, istio, mattermost, snyk-cli, k9s, loki, flux, kubescape, cilium, cilium-cli, kots, external-dns, rancher, aactl, flux-image-automation-controller, k3s, fscrypt,...
CVE-2026-46598 vulnerabilities
Vulnerabilities for packages: spire-server, opentofu, kubernetes, opentelemetry-collector, istio, podman, mattermost, snyk-cli, loki, flux, cilium-cli, cilium, buildah, kots, external-dns, docker-cli-buildx, rancher, aactl, k3s, fscrypt, prometheus, kaf, kine, kyverno, containerd, minio,...
CVE-2026-39834 vulnerabilities
Vulnerabilities for packages: gatus, apko, tekton-chains, crossplane-provider-aws-cloudfront, argo-events, zarf, flux-source-controller, istio, step-issuer, ko, crossplane-provider-aws-eks, terraform-provider-acme, traefik, kots, docker-cli-buildx, docker-compose,...
WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Line Agency versions = 1.3.1...
CVE-2026-46595 vulnerabilities
Vulnerabilities for packages: prometheus-operator, omnictl-multiarch-fips, telegraf, gatekeeper, zitadel, etcd-fips, containerd, drone-fips, grafana, calico-fips, etcd, gitlab-kas, tekton-pipelines-fips, minio, kubernetes, argocd-image-updater, seaweedfs-rocksdb-fips, snyk-cli, argo-cd-fips,...
CVE-2026-39832 vulnerabilities
Vulnerabilities for packages: prometheus-operator, step-issuer, omnictl-multiarch-fips, telegraf, gatekeeper, zitadel, etcd-fips, mapotf, act, containerd, nfpm, grafana, pulumi-language-yaml, terragrunt, buildah-fips, calico-fips, etcd, gitlab-kas, tekton-pipelines-fips, minio, chezmoi, kubernete...
USN-8321-1: Papers vulnerability
It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code...
CVE-2026-45842
A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol and PPP Point-to-Point Protocol components. An unprivileged local user can exploit this vulnerability by manipulating the PPPIOCSMAXCID ioctl to configure the SLIP Compressed Header SLHC state incorrectly. This...
CVE-2026-45843
A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP implementation. The slhcuncompress function, which handles VJ-compressed TCP headers, fails to perform proper bounds checks during packet processing. A remote attacker could exploit this by sending a specially crafted...
