CVE-2026-100889

A flaw was found in OpenDKIM. An off-by-one boundary error in the quoted-printable decoder function dkimqpdecode allows a remote attacker to trigger memory corruption by submitting specially crafted input. This issue primarily causes the application to crash, leading to a Denial of Service DoS...

CVE-2024-54951

Monica-Stored-XSS-Vulnerability CVE-2024-54951 CVE-2024-54951 I contacted the monica development team via email on 11/20/2024. I also contacted them via LinkedIn through connection message attempt, and other platforms in the weeks that followed. Publishing here since there was no response after 3...

Improper Validation of Specified Quantity in Input

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...

CVE-2021-3129

CVE-2021-3129 Generate a phar package with custom commands: php -d'phar.readonly=0' ./phpggc monolog/rce1 system "cat /etc/passwd" --phar phar -o php://output | base64 -w0 php -a enter the php command line environment $fp = fopen'php://output', 'w'; streamfilterappend$fp,...

USN-8808-1: SQL parse vulnerabilities

It was discovered that SQL parse contained multiple algorithmic complexity flaws when parsing SQL statements with deeply nested parentheses, comments, or dollar-quoted string literals. An attacker could use this issue to cause SQL parse to consume excessive CPU resources, resulting in a denial of...

USN-8808-1 sqlparse vulnerabilities

It was discovered that SQL parse contained multiple algorithmic complexity flaws when parsing SQL statements with deeply nested parentheses, comments, or dollar-quoted string literals. An attacker could use this issue to cause SQL parse to consume excessive CPU resources, resulting in a denial of...

io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerability in jackc/pgx

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package jackc/pgx PostgreSQL driver that is affected by a critical-severity SQL injection vulnerability. IBM Optim 2.0.0 resolves this vulnerability by upgrading the affected open-source dependency to a fixed version...

CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

UBUNTU-CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57228

Suricata versions 7.0.13 through 7.0.17 are vulnerable to a heap out-of-bounds read in the SMTP MIME quoted-printable decoder located in src/util-decode-mime.c. This flaw occurs when a quoted-printable escape sequence is split across traffic chunks and the subsequent chunk contains exactly one by...

CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

EUVD-2026-83383

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

GHSA-269C-H76Q-8CXW Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...

Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...

Astra Linux – Vulnerability in Jetty9

Jetty is a Java-based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or perform unintended behaviors by tampering with the cookie parsing mechanism. If Jetty encounters a cookie value that starts with a double quot...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...