https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:38:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358972 EUVD-2026-358972 https://cve.radiocsirt.org/vuln/euvd-2026-358972 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77634 <p>CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-77634 https://cve.radiocsirt.org/vuln/ghsa-2qh5-382h-3jpc <p><strong>Affected:</strong> Packagist: cakephp/cakephp</p> <p>### Impact</p> <p>Custom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.</p> <p>### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.</p> <p>### Workarounds You can strip CRLF bytes from email header values before setting header values.</p> <p><strong>Affected:</strong> Packagist: cakephp/cakephp</p> <p>### Impact</p> <p>Custom mail headers added with `Message::setHeaders()` or `addHeaders()` do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes.</p> <p>### Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue.</p> <p>### Workarounds You can strip CRLF bytes from email header values before setting header values.</p> https://cve.radiocsirt.org/vuln/ghsa-2qh5-382h-3jpc https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-77634 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-77634