CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed (CRLF) characters, enabling attackers with elev...

CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-62243

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Summary Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil,...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

Security Vulnerabilities fixed in Firefox for iOS 155.0 — Mozilla

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content...

PT-2026-83972

net ipv6 send ns in subsys/net/ip/ipv6 nbr.c allocates a transmit net pkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pending queue is already non-empty an NS is already outstanding, the function appends the data packet a...

Fedora 44 : opkssh (2026-f5a5073561)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f5a5073561 advisory. Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 IP...

Fedora 43 : opkssh (2026-8d9ba295e0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8d9ba295e0 advisory. Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 IP...

Linux Distros Unpatched Vulnerability : CVE-2026-82853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery (CSRF) vulnerability in sendEmail.json.php . The root cause is the bypass of origin checks and captcha validation , allowing an attacker to craft a malicious web page that, when visited by an authenticated admin, sends emails from the site's conta...

CVE-2026-82647 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

EUVD-2026-68233

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

Improper Handling of Length Parameter Inconsistency

Overview resolv is a Thread-aware DNS resolver library in Ruby. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via Resolv::DNS::MessageEncoderputstring, putlabel, and Resolv::DNS::Name.create in lib/resolv.rb. An attacker can make an...

Linux Distros Unpatched Vulnerability : CVE-2026-33604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body t...

Security Bulletin: Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Summary Langflow contains two vulnerabilities affecting client-side security and access control integrity. The MarkdownField component renders chat messages using the rehypeRaw plugin without a sanitization pass, causing attacker-controlled LLM response text containing raw HTML to be inserted...