CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

EUVD-2026-63189

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

PT-2026-78875

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same origin path accepts a backslash or tab in the return parameter. oauth2 login reads the return parameter from the initiation request, runs same origin path over it, and stores the survivo...

Security update for dovecot22

This update for dovecot22 fixes the following issues CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection bsc1265147. CVE-2026-40020: IMAP folders can be shared-spammed to everyone bsc1265149. CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing...

SUSE-SU-2026:2645-1 Security update for dovecot22

This update for dovecot22 fixes the following issues - CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection bsc1265147. - CVE-2026-40020: IMAP folders can be shared-spammed to everyone bsc1265149. - CVE-2026-42006: imap-login: uncontrolled memory usage with excessive...

EUVD-2026-5157

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character \t followed by arbitrary content ...