@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a l...

CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only o

历史摘要 · 未重新核验 · NVD

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into ...

CVE-2026-75484

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated r

历史摘要 · 未重新核验 · NVD

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain

历史摘要 · 未重新核验 · GitHub Advisory

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rej...

CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), a

历史摘要 · 未重新核验 · NVD

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly...

CVE-2026-71573

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementat

历史摘要 · 未重新核验 · NVD

Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple...

CVE-2026-71572

Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of out

历史摘要 · 未重新核验 · NVD

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?...

CVE-2026-45125

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names c

历史摘要 · 未重新核验 · NVD

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating ...

CVE-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allow

历史摘要 · 未重新核验 · NVD

rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

CVE-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allow

历史摘要 · 未重新核验 · OSV.dev

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privilege...

CVE-2026-16455

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 throu

历史摘要 · 未重新核验 · NVD

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's std...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

历史摘要 · 未重新核验 · NVD

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafte...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

历史摘要 · 未重新核验 · NVD

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline

历史摘要 · 未重新核验 · GitHub Advisory

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV r...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline

历史摘要 · 未重新核验 · NVD

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_for...

CVE-2026-0673

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to

历史摘要 · 未重新核验 · NVD

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in ba...

CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · NVD

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines in...

CVE-2026-70615

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users wit

历史摘要 · 未重新核验 · NVD

undici vulnerable to CRLF Injection via blob-like body 'type' property

CVE-2026-15157

### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `st

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents throu...

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inj

历史摘要 · 未重新核验 · NVD

YAML injection via unescaped newlines in ymlr document comments

CVE-2026-65636

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inj

历史摘要 · 未重新核验 · OSV.dev