CVE-2026-93563

A flaw was found in Netty's SmtpResponseDecoder component. A remote attacker, acting as a malicious or man-in-the-middle MITM SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory...

CVE-2026-90767

Froxlor versions before 2.3.12 contain an SSH key injection vulnerability in the SshKeys::add() API endpoint. The root cause is improper validation of multi-line SSH public keys , allowing customers to inject arbitrary lines into authorized_keys files. An attacker can exploit this to inject malic...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

PT-2026-90834

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorized keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

ralph

Ralph Claude Code 向け Ralph Wiggum 自律ループ手法の動作する実装です。 背景 Anthropic のプラグインマーケットプレイスにある公式 ralph-wiggum プラグインは、Claude Code v1.0.20（2025年8月）のセキュリティアップデートにより現在動作していません。 セキュリティパッチ（CVE-2025-54795）は、コマンドインジェクション攻撃を防ぐため、$ コマンド置換と複数行の bash コマンドを正しくブロックします。しかし、公式プラグインのコマンドファイルには、この保護を発動させる複数行の bash が含まれています：...

EUVD-2026-65222

GitPython: Dormant multi-line git-config values are corrupted into live injected directives e.g. core.hooksPath on any unrelated GitConfigParser write, enabling RCE...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Resource Exhaustion

Spring Batch is vulnerable to resource exhaustion. The vulnerability is due to the way FlatFileItemReader assembles multi-line records, where a specially crafted input file can cause excessive CPU consumption and memory usage, leading the batch job to stall or run out of memory...

CVE-2026-47881

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

EUVD-2026-66844

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

CVE-2026-47881

CVE-2026-47881 is a denial-of-service vulnerability in Spring Batch 's FlatFileItemReader (versions 4.3.0–4.3.13 , 5.2.0–5.2.6 , and 6.0.0–6.0.4 ). A specially crafted input file exploiting multi-line record assembly can cause excessive CPU and memory consumption, stalling or exhausting the batch...

DEBIAN-CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676

GitPython versions before 3.1.59 are vulnerable to remote code execution via git-config injection. The root cause is unsafe re-serialization of multi-line git-config values during write operations: embedded newlines in quoted values are corrupted into live directives such as core.hooksPath . An a...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Linux Distros Unpatched Vulnerability : CVE-2026-78676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible, where a user’s controller is vulnerable to template injection. This issue can occur when facts used in the template do not include special template characters, especially if the user attempts to embed templates within multi-line YAML strings. This flaw allows...