Monthly
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.
Certificate validation in OpenSSL-based OpenVPN builds can be subverted by a peer that presents an X.509 certificate whose subject contains an embedded NULL byte, because subject-name parsing truncates at the NUL and the crafted certificate is then accepted as valid (CVE-2026-84790, CWE-158). Deployments at risk are OpenSSL-linked OpenVPN builds older than v2.7.8 that use certificate-based authentication; mbedTLS builds are not affected because they always rejected such certificates. The independent assessment scores this as CVSS:3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (attack complexity high, some position/privilege assumed, and a purpose-built certificate required), which is consistent with the vendor's CVSS 4.0 score of 7.6 High; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Search Head Clustering bundle replication in Splunk Enterprise fails to validate bundle filenames or neutralize NUL bytes before constructing file system paths on non-captain cluster members, allowing any authenticated low-privileged user to delete or temporarily overwrite files accessible to the Splunk service account via a crafted REST API request. Affected are Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 running in SHC deployments - standalone instances are not in scope. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, vendor patch is available via advisory SVD-2026-0801 and the low privilege barrier makes this a credible insider or stolen-credential threat in SOC environments.
Null byte injection in the UDM's Nudm_SubscriberDataManagement API allows unauthenticated remote attackers to crash the service by embedding URL-encoded %00 characters in the supi parameter, triggering unhandled parsing errors and denial of service. The vulnerability stems from improper input validation that permits control characters to reach Go's URL parser, which rejects them with a 500 error instead of sanitizing the input upstream. A patch is available.
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through null byte injection in user/admin web interfaces that enables arbitrary Lua code execution in session files. With EPSS 92.7% and KEV listing, this vulnerability guarantees unauthenticated root/SYSTEM code execution on affected servers, as the FTP service runs with maximum privileges by default.
A NUL character (U+0000) embedded in content that reaches a log message causes Apache log4net's OutputDebugStringAppender to truncate the emitted debug record at that point, silently discarding everything the layout rendered afterwards, including exception text and trailing fields. Only Windows applications that explicitly configure the non-default OutputDebugStringAppender are affected, across log4net versions from 1.2.9 up to (but excluding) 3.5.0. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) the flaw is unauthenticated and remotely reachable where attacker-controlled data is logged, but it is limited to log-record integrity with no confidentiality, availability, or code-execution impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so overall real-world risk is low-to-moderate.
Log-record truncation in Apache log4net's EventLogAppender silently drops everything a layout renders after a NUL (\0) character, so a party whose data reaches a log message can hide the remainder of that Windows Event Log record - including exception text and trailing fields - with no error raised. The flaw (CWE-158, CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) affects Apache log4net from 1.2.9 before 3.5.0 and only Windows applications configured to use EventLogAppender; non-Windows hosts and any other appender are unaffected. Impact is limited to integrity of a single log entry (no code execution, confidentiality or availability loss), and no public exploit code was identified at time of analysis - this is a medium/low-priority log-suppression issue rather than an urgent compromise vector. The upstream fix escapes NUL characters before the message-size limit is applied and is shipped in log4net 3.5.0.
Certificate SAN validation in Envoy Proxy is bypassed when an attacker-controlled upstream serves a TLS certificate containing an embedded NUL byte in the dNSName Subject Alternative Name field. Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are affected, allowing an attacker who controls or can impersonate an upstream TLS endpoint to pass Envoy's configured SAN match check with a fraudulent certificate and intercept proxied traffic. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Jq 1.8.1 and earlier truncate filter files at the first embedded NUL byte when loaded with -f, causing only the prefix before the NUL to execute. A crafted filter file containing a NUL byte and arbitrary suffix allows an attacker to inject malicious code that compiles and runs silently, bypassing intended filter logic and potentially modifying JSON output in undetected ways. This represents a post-CVE-2026-33948 regression on the compilation path.
mutt before version 2.3.2 fails to validate null bytes during URL percent-decoding, allowing remote attackers to inject embedded null characters into decoded URLs, potentially causing information disclosure through truncation of validation checks or bypassing of security filters that rely on string length.
Arbitrary code execution in Aegisub 3.2.0 through 3.4.2 occurs when a victim opens a crafted .ass subtitle project whose 'Automation Scripts' metadata references an attacker-supplied Lua Automation script, which Aegisub auto-loads without prompting the user to trust the script or its author and runs with the privileges of the Aegisub process. Versions 3.4.0 through 3.4.2 add a single-file attack path in which inconsistent handling of embedded NUL characters between extension validation and filesystem operations lets a crafted ASS/Lua polyglot reference and execute itself, removing the need to deliver a separate script file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), making it a local, user-interaction-driven issue that does not affect any network service; there is no public exploit identified at time of analysis, so real-world urgency is moderate rather than critical, and Aegisub 3.5.0 fixes the vulnerability.
Certificate validation in OpenSSL-based OpenVPN builds can be subverted by a peer that presents an X.509 certificate whose subject contains an embedded NULL byte, because subject-name parsing truncates at the NUL and the crafted certificate is then accepted as valid (CVE-2026-84790, CWE-158). Deployments at risk are OpenSSL-linked OpenVPN builds older than v2.7.8 that use certificate-based authentication; mbedTLS builds are not affected because they always rejected such certificates. The independent assessment scores this as CVSS:3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (attack complexity high, some position/privilege assumed, and a purpose-built certificate required), which is consistent with the vendor's CVSS 4.0 score of 7.6 High; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Search Head Clustering bundle replication in Splunk Enterprise fails to validate bundle filenames or neutralize NUL bytes before constructing file system paths on non-captain cluster members, allowing any authenticated low-privileged user to delete or temporarily overwrite files accessible to the Splunk service account via a crafted REST API request. Affected are Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 running in SHC deployments - standalone instances are not in scope. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, vendor patch is available via advisory SVD-2026-0801 and the low privilege barrier makes this a credible insider or stolen-credential threat in SOC environments.
Null byte injection in the UDM's Nudm_SubscriberDataManagement API allows unauthenticated remote attackers to crash the service by embedding URL-encoded %00 characters in the supi parameter, triggering unhandled parsing errors and denial of service. The vulnerability stems from improper input validation that permits control characters to reach Go's URL parser, which rejects them with a 500 error instead of sanitizing the input upstream. A patch is available.
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through null byte injection in user/admin web interfaces that enables arbitrary Lua code execution in session files. With EPSS 92.7% and KEV listing, this vulnerability guarantees unauthenticated root/SYSTEM code execution on affected servers, as the FTP service runs with maximum privileges by default.
A NUL character (U+0000) embedded in content that reaches a log message causes Apache log4net's OutputDebugStringAppender to truncate the emitted debug record at that point, silently discarding everything the layout rendered afterwards, including exception text and trailing fields. Only Windows applications that explicitly configure the non-default OutputDebugStringAppender are affected, across log4net versions from 1.2.9 up to (but excluding) 3.5.0. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) the flaw is unauthenticated and remotely reachable where attacker-controlled data is logged, but it is limited to log-record integrity with no confidentiality, availability, or code-execution impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so overall real-world risk is low-to-moderate.
Log-record truncation in Apache log4net's EventLogAppender silently drops everything a layout renders after a NUL (\0) character, so a party whose data reaches a log message can hide the remainder of that Windows Event Log record - including exception text and trailing fields - with no error raised. The flaw (CWE-158, CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) affects Apache log4net from 1.2.9 before 3.5.0 and only Windows applications configured to use EventLogAppender; non-Windows hosts and any other appender are unaffected. Impact is limited to integrity of a single log entry (no code execution, confidentiality or availability loss), and no public exploit code was identified at time of analysis - this is a medium/low-priority log-suppression issue rather than an urgent compromise vector. The upstream fix escapes NUL characters before the message-size limit is applied and is shipped in log4net 3.5.0.
Certificate SAN validation in Envoy Proxy is bypassed when an attacker-controlled upstream serves a TLS certificate containing an embedded NUL byte in the dNSName Subject Alternative Name field. Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1 are affected, allowing an attacker who controls or can impersonate an upstream TLS endpoint to pass Envoy's configured SAN match check with a fraudulent certificate and intercept proxied traffic. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Jq 1.8.1 and earlier truncate filter files at the first embedded NUL byte when loaded with -f, causing only the prefix before the NUL to execute. A crafted filter file containing a NUL byte and arbitrary suffix allows an attacker to inject malicious code that compiles and runs silently, bypassing intended filter logic and potentially modifying JSON output in undetected ways. This represents a post-CVE-2026-33948 regression on the compilation path.
mutt before version 2.3.2 fails to validate null bytes during URL percent-decoding, allowing remote attackers to inject embedded null characters into decoded URLs, potentially causing information disclosure through truncation of validation checks or bypassing of security filters that rely on string length.