CVE-2026-100717 | Critical | 9.9 | 2026-09-26 | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the pa… |
CVE-2026-91841 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline chara… |
CVE-2026-91840 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character i… |
CVE-2026-91839 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-f… |
CVE-2026-61815 | High | 7.2 | 2026-09-24 | zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822… |
CVE-2026-90990 | | | 2026-09-22 | Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject a… |
CVE-2026-55159 | High | 8.8 | 2026-09-21 | luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci… |
CVE-2026-94057 | Medium | 4.0 | 2026-09-19 | Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejec… |
CVE-2026-93576 | High | 7.5 | 2026-09-18 | A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-nam… |
CVE-2026-40530 | High | 8.0 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72… |
CVE-2026-13666 | Low | 3.5 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2… |
CVE-2026-90819 | High | 7.3 | 2026-09-14 | A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file s… |
CVE-2026-90937 | Critical | 9.9 | 2026-09-14 | froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apa… |
CVE-2026-90767 | Medium | 6.5 | 2026-09-13 | Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into a… |
CVE-2026-86813 | Medium | 4.8 | 2026-09-11 | The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email head… |
CVE-2026-19862 | Medium | 4.8 | 2026-09-06 | The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before addi… |
CVE-2026-48019 | High | 8.9 | 2026-09-04 | Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination wit… |
CVE-2026-75925 | Critical | 9.6 | 2026-09-04 | Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration value… |
CVE-2026-84962 | Medium | 4.2 | 2026-09-03 | An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorize… |
CVE-2026-84379 | Medium | 5.3 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attack… |
CVE-2026-84372 | Critical | 9.8 | 2026-09-01 | Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster a… |
CVE-2026-82854 | Critical | 9.8 | 2026-08-31 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope o… |
CVE-2026-82853 | Medium | 4.9 | 2026-08-31 | Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is… |
CVE-2026-82661 | Medium | 5.4 | 2026-08-31 | Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message heade… |
CVE-2026-33606 | Medium | 4.8 | 2026-08-28 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protoc… |
CVE-2026-77341 | | | 2026-08-28 | cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directl… |
CVE-2026-59313 | Critical | 9.8 | 2026-08-27 | Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7… |
CVE-2026-47890 | Critical | 9.8 | 2026-08-27 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8… |
CVE-2026-54511 | High | 8.6 | 2026-08-26 | LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/s… |
CVE-2026-77550 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS… |
CVE-2026-77549 | Critical | 9.0 | 2026-08-26 | A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in cer… |
CVE-2026-77634 | | | 2026-08-24 | CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail head… |
CVE-2026-75922 | Medium | 5.3 | 2026-08-23 | Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.
PSGI… |
CVE-2026-74866 | Medium | 5.8 | 2026-08-21 | @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-fee… |
CVE-2026-75484 | | | 2026-08-20 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NU… |
CVE-2026-53533 | | | 2026-08-18 | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied add… |
CVE-2026-71573 | High | 8.3 | 2026-08-18 | Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins f… |
CVE-2026-71572 | Medium | 5.4 | 2026-08-18 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injecti… |
CVE-2026-45125 | Medium | 5.3 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header inje… |
CVE-2026-53788 | Medium | 6.5 | 2026-08-13 | rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol mes… |
CVE-2026-16455 | | | 2026-08-13 | In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby… |
CVE-2026-72913 | | | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the… |
CVE-2026-72590 | Critical | 9.8 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries b… |
CVE-2026-61477 | Low | 2.3 | 2026-08-07 | An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value at… |
CVE-2026-0673 | Medium | 5.3 | 2026-08-06 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `elemen… |
CVE-2026-71311 | Medium | 6.4 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filen… |
CVE-2026-70615 | Critical | 9.9 | 2026-08-05 | boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject… |
CVE-2026-65636 | | | 2026-07-31 | Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YA… |
CVE-2026-44092 | Critical | 9.1 | 2026-07-30 | An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. Th… |
CVE-2026-15157 | Medium | 4.2 | 2026-07-29 | undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In und… |
CVE-2026-12357 | High | 7.2 | 2026-07-29 | Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2026-59920 | Medium | 6.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubfram… |
CVE-2026-59919 | Medium | 5.5 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMes… |
CVE-2026-59921 | Medium | 5.7 | 2026-07-28 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multi… |
CVE-2026-57511 | Medium | 5.4 | 2026-07-28 | SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CR… |
CVE-2026-16313 | High | 7.6 | 2026-07-28 | A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control charact… |
CVE-2026-45070 | Medium | 6.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45067 | | | 2026-07-14 | ### Description
`Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is… |
CVE-2026-15429 | High | 8.8 | 2026-07-14 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow new… |
CVE-2026-50188 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::reque… |
CVE-2026-12127 | Medium | 5.3 | 2026-07-01 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of… |
CVE-2026-57281 | High | 7.5 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing att… |
CVE-2026-55766 | Medium | 4.8 | 2026-06-23 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party… |
CVE-2026-55603 | High | 7.5 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a… |
CVE-2026-47242 | | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash a… |
CVE-2026-47240 | | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw… |
CVE-2026-50269 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload head… |
CVE-2026-11373 | Critical | 9.1 | 2026-06-22 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant… |
CVE-2026-9679 | Medium | 5.9 | 2026-06-17 | Impact:
undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into th… |
CVE-2026-12143 | High | 7.5 | 2026-06-12 | form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filenam… |
CVE-2026-50629 | Medium | 5.3 | 2026-06-12 | The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. Th… |
CVE-2026-49214 | Medium | 5.3 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in… |
CVE-2026-50639 | Medium | 6.5 | 2026-06-10 | Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions such as dogstats… |
CVE-2026-50638 | Critical | 9.1 | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions such as dogstat… |
CVE-2026-50637 | High | 8.2 | 2026-06-10 | Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions) allow mutiple met… |
CVE-2026-49756 | Low | 3.7 | 2026-06-08 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part… |
CVE-2026-9270 | Critical | 9.1 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of… |
CVE-2026-11362 | Critical | 9.8 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.
DataDog::DogStatsd does not properly sanitise input, allowing metri… |
CVE-2026-50292 | High | 7.4 | 2026-06-04 | In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execu… |
CVE-2026-46741 | High | 7.5 | 2026-06-04 | Etsy::StatsD versions through 1.002002 for Perl allow metric injections.
The metric names and values are not checked for newlines, colons or pipes. Metrics ge… |
CVE-2026-46739 | Medium | 5.3 | 2026-06-04 | Net::Statsd versions before 0.13 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics generated from untr… |
CVE-2026-8722 | Medium | 6.5 | 2026-06-04 | Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics ge… |
CVE-2026-48861 | | | 2026-06-02 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling.
In li… |
CVE-2026-45372 | Critical | 9.9 | 2026-05-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it app… |
CVE-2026-49130 | Medium | 5.3 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that al… |
CVE-2026-46740 | Medium | 5.3 | 2026-05-26 | Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or… |
CVE-2026-44214 | Medium | 5.8 | 2026-05-26 | eventsource-encoder encodes events as well-formed EventSource/Server Sent Event (SSE) messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event… |
CVE-2026-47075 | High | 7.5 | 2026-05-25 | Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r)… |
CVE-2026-47072 | High | 7.5 | 2026-05-25 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade cod… |
CVE-2026-47069 | Medium | 5.3 | 2026-05-25 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting. The hackney_cookie:setcookie/3 fu… |
CVE-2026-8788 | High | 7.3 | 2026-05-18 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
The values from the set_add method were not checked for newlines, colons or pipe… |
CVE-2026-46720 | High | 8.2 | 2026-05-17 | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or pipes. Me… |
CVE-2026-46719 | Medium | 6.5 | 2026-05-16 | Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
The metric names were not checked for newlines, colons or pipes. Metrics generated… |
CVE-2026-32993 | High | 8.3 | 2026-05-13 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header… |
CVE-2026-42586 | Medium | 6.8 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) wri… |
CVE-2026-42578 | High | 7.5 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT… |
CVE-2026-35504 | Medium | 5.5 | 2026-05-12 | PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. |
CVE-2026-44217 | | | 2026-05-12 | sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided va… |
CVE-2026-43882 | Medium | 4.3 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attack… |
CVE-2026-43969 | Low | 3.2 | 2026-05-11 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidat… |