CVE-2026-0864
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the
CVSS
5.5
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jun 23, 2026 · Last modified: Aug 18, 2026 · CWE-74
0.1%EPSS · 30 days0.1%
2026-08-032026-08-31
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
- github.comhttps://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528
- github.comhttps://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd
- github.comhttps://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908
- github.comhttps://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f
- github.comhttps://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98
- github.comhttps://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8
- github.comhttps://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6
- github.comhttps://github.com/python/cpython/issues/143927
- github.comhttps://github.com/python/cpython/pull/151559
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-827017.3 HIG—
——0A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.1dCVE-2026-826966.3 MED—
——0A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.1dCVE-2026-826664.7 MED30.3%
——9A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.1dCVE-2026-826206.3 MED10.4%
——3A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.1dCVE-2026-826157.3 HIG18.6%
——6A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.1dCVE-2026-826147.3 HIG17.9%
——5A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.1d