CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

EUVD-2024-55736

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service (ReDoS) vulnerability in email parsing, triggered when the attachDataUrls parameter is set or when processing embedded file attachments. Attackers can send specially crafted emails containing malicious data URLs or embedded a...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

K000163144: Spring Data vulnerability CVE-2026-41696

Security Advisory Description Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected...

CyberLabs-SOC-L1-RetailBreach

🛡️ CyberLabs SOC L1 – RetailBreach Investigation Overview...

K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936

Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...

Exploit for CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Ph...

CVE-2026-80694

A flaw was found in the Linux kernel's mtkethsoc Ethernet driver. The mtkpollcontroller function incorrectly passed a netdevice pointer instead of an mtketh structure to mtkhandleirqrx. This incorrect parameter passing can lead to a system crash when ndopollcontroller is called with...

CVE-2026-40465

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

EUVD-2026-68374

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-40465

Nokia NSP (Network Service Platform) is vulnerable to an open redirect caused by insufficient server-side validation of the URL or redirect parameter. An attacker can craft a malicious URL that redirects users to an untrusted destination, potentially facilitating phishing attacks. The CVSS 3.1 sc...

CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

CVE-2026-82727

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

awspwn

AWSPwn - AWS attack-path automation Enumerate an account's IA...

EEF-CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...