8514 matches found
PSF-2026-5
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters...
binary-parser library has a code injection vulnerability
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without...
CVE-2026-0865
CVE-2026-0865: Python’s wsgiref.headers allows header newline injection via user-controlled header names/values. Affects CPython components handling HTTP headers; multiple OS vendors reference this in advisories (e.g., RHSA-2026:2128, USN-8018-1, ALSA-2026:2128, DLA-4455). Mitigation is to upgrad...
CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
CVE-2026-0865 wsgiref.headers.Headers allows header newline injection
User-controlled header names and values containing newlines can allow injecting HTTP headers...
CVE-2026-1245
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without...
CVE-2026-1245
The binary-parser library for Node.js is vulnerable to a code injection flaw in versions prior to 2.3.0 . The root cause is the library's use of the Function constructor to dynamically generate JavaScript code at runtime, where it directly interpolates parser field names and encoding parameters w...
CVE-2026-1245 CVE-2026-1245
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without...
MiracleLinux 8 : 389-ds:1.4 (AXSA:2024-8413:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8413:01 advisory. 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars in logentryattr CVE-2024-1062 Tenable has extracted the...
transfig security update
1:3.2.6a-5 - Detect nan in spline control values - Fix for CVE-2025-46397...
An Optimized Decision Tree-Based Framework for Explainable IoT Anomaly Detection
The increase in the number of Internet of Things IoT devices has tremendously increased the attack surface of cyber threats thus making a strong intrusion detection system IDS with a clear explanation of the process essential towards resource-constrained environments. Nevertheless, current IoT ID...
SUSE CVE-2017-18900
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report...
UBUNTU-CVE-2025-61873
Best Practical Request Tracker RT before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used...
EUVD-2026-2913
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...
CVE-2025-61873
Best Practical Request Tracker RT before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used...
CVE-2025-61873: Improper Neutralization of Formula Elements in a CSV File
Best Practical Request Tracker RT before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used...
CVE-2025-61873
Summary: CVE-2025-61873 affects Best Practical Request Tracker (RT). The connected Debian advisory confirms the issue is a CSV injection vulnerability in RT exports to TSV from search results, caused by ticket values containing certain characters and exported in TSV, enabling injection. Debian li...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003767)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003767 advisory. In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols e.g., UDP and ICMP...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003664)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003664 advisory. In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols e.g., UDP and ICMP...