OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches.
Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0.
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer). This issue has been patched in version 0.18.0.
CVE-2026-35038 is a low-severity vulnerability in SignalK Server versions prior to 2.24.0. It involves improper input validation that allows a low-privileged authenticated user to bypass prototype boundary filtering via the 'from' field. This enables the user to read internal functions and properties from the global prototype object, violating data isolation. The vulnerability has been patched in version 2.24.0.
phpMyFAQ versions prior to 4.1.1 contain an input validation vulnerability where an unauthenticated attacker can submit a guest FAQ with an email address that includes raw HTML. The email passes PHP's FILTER_VALIDATE_EMAIL but is stored without HTML sanitization and rendered with Twig's |raw filter, bypassing auto-escaping. This can lead to cross-site scripting (XSS) in the admin FAQ editor. The issue is fixed in version 4.1.1.
CVE-2026-29144 is a high-severity vulnerability in SEPPmail Secure Email Gateway versions prior to 15.0.3. It involves improper input validation that allows an attacker to bypass subject sanitization and forge security tags by using Unicode lookalike characters. This could undermine the integrity of email security features. No official patch or remediation details are provided in the available data. The vulnerability has not been reported as exploited in the wild.
CVE-2026-29143 is a high-severity vulnerability in SEPPmail Secure Email Gateway versions prior to 15.0.3. The issue arises from improper input validation where the product does not properly authenticate the inner message of S/MIME-encrypted MIME entities. This flaw allows an attacker to manipulate trusted email headers. The vulnerability has a CVSS 4.0 base score of 7.8, indicating significant risk, but no known exploits have been reported in the wild. No official patch link or vendor advisory is provided in the available data.
CVE-2026-29137 is a medium severity vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It involves improper input validation (CWE-20) where an attacker can craft a long email subject to hide security tags from users. This could potentially mislead users about the security status of an email. No known exploits are reported in the wild. There is no explicit patch information provided, and the vendor advisory status is not available in the input data.
CVE-2026-29141 is a high-severity vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It involves improper input validation that allows an attacker to bypass subject sanitization and forge tags such as [signed OK]. This could mislead recipients about the authenticity or status of an email. The vulnerability has a CVSS 4.0 base score of 7.7, indicating significant risk. No official patch or fix information is provided in the available data. There are no known exploits in the wild as of the published date.
CVE-2026-29135 is a medium severity vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It involves improper input validation where an attacker can craft a password-tag that bypasses subject sanitization. This could potentially allow manipulation of email subjects in ways not intended by the system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. There are no known exploits in the wild and no official patch information provided yet.
CVE-2026-29133 is a medium severity vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It allows an attacker with limited privileges to upload PGP keys containing user IDs (UIDs) that do not match the associated email addresses. This improper input validation issue could potentially lead to trust or identity confusion in email encryption processes. No known exploits are reported in the wild, and no official patch information is provided in the available data.
### Summary
Multiple Host headers were allowed in aiohttp.
### Impact
Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (http://localhost:8080/system/status) allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. When the application constructs links and assets using the unvalidated Host header, user requests can be redirected to attacker-controlled domains and external resources may be loaded from malicious servers. This issue has been patched in version 1.8.211.
A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database.
A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive.
Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI) to execute arbitrary operating system commands as the root user on the Socket’s internal system.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation solely based on the value of a user-controlled parameter. This makes it possible for unauthenticated attackers to bypass configured form payment-amount validation and create underpriced payment/subscription intents by setting form_id to 0.
The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected. Because of that, a crafted DER input can cause `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`) rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service. Version 0.19.2 patches the issue.