CVE-2026-17084: Interpretation Conflict

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 the "idna" codec and the intable...

glassworm-hunter v1.0.4

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

ROS-20260817-73-0211

The vulnerability in python-setuptools is related to incorrect data processing based on the Unicode encoding standard. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Important: perl-Date-Manip

Issue Overview: Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

DEBIAN-CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

UBUNTU-CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

expat: libexpat: Denial of Service due to incorrect Unicode surrogate handling

A flaw in libexpat's toUtf16 functions mishandles Unicode low surrogates by treating them as high surrogates. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service DoS...

CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

EUVD-2026-58670

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

Linux Distros Unpatched Vulnerability : CVE-2026-19879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit...

CVE-2026-73420

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...