Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
CVE-2026-82854
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an
2026-09-01 归档
今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表Nodemailer before 8.0.5 SMTP Command Injection via CRLF
CVE-2026-82853
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH
Nodemailer before 8.0.8 TLS Certificate Validation Bypass
CVE-2026-82662
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, a
Nodemailer CRLF Injection via List-* Header Comments
CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing atta
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
CVE-2026-82660
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in
nodemailer before 9.0.1 File Read and SSRF via raw option
CVE-2026-82659
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowin
nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
CVE-2024-58379
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUr
PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery
CVE-2026-82630
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnecti
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
CVE-2026-82623
A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backe
Systerel S2OPC subscription_mgr.c use after free
CVE-2026-82619
A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
CVE-2026-82725
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
CVE-2026-82724
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
CVE-2026-82726
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash app
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
CVE-2026-82727
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
CVE-2026-82608
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modul
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
CVE-2026-81853
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into a
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
CVE-2026-82681
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
CVE-2026-82722
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can rea
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
CVE-2026-75757
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker wh
AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
CVE-2026-75760
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider requ