Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,700 results · page 9 of 114
Aug 27, 2026openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge theCVE-2026-81707 · Other software · jahlives · reported by VulnCheckCritical 9.3
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigurCVE-2026-81691 · Other software · jahlives · reported by VulnCheckHigh 8.7
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 26, 2026The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail AddressCVE-2026-56547 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects them back in the generated Apple profile. The Apple profile is not usable without additional information and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values submitted and reflected back in the Apple profile are found in the Domino directory entry for the already authenticated user.
- Product
- Traveler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 26, 2026Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration.CVE-2026-81036 · Other software · stalwartlabs · reported by VulnCheckHigh 8.5
Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a registered client nor otherwise constrained. The value is stored with the authorization code, and the login page reads it back and sends the browser to it with the code attached. A request naming a destination the attacker controls therefore delivers a valid authorization code there once the account holder authenticates, and because the token endpoint checks only that the redirect presented at exchange matches the one recorded with the code, the same party can exchange it for access and refresh tokens and read the account's mail.
- Product
- stalwart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Netmaker disables certificate verification on the connection to the configured mail server.CVE-2026-81034 · Other software · gravitl · reported by VulnCheckHigh 8.3
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No configuration value governs it and no code path restores verification, so the client accepts any certificate the mail server presents, including one an interposing party supplies. Mail that Netmaker sends over that connection includes password-reset messages carrying single-use tokens and user invitations carrying enrolment links, so a party positioned on the path between the server and its mail relay can read those messages in transit and use a captured reset token before the intended recipient does. The setting is absent from the development branch but present in the latest release.
- Product
- netmaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplieCVE-2026-54467 · Other software · TrustedFirmware · reported by MITREHigh 7
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
- Product
- Trusted Firmware-M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreview.trustedfirmware.orgtrustedfirmware.org
Aug 25, 2026Vulnerability in Drupal Email Login OTP.CVE-2026-16642 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information.CVE-2026-55620 · Other software · GOVCERT-LU · reported by GitHubHigh 7.5
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based fix-point loop whose running time is quadratic in the nesting depth. A single Received: header with 5,000 nested parentheses causes approximately 1.3 seconds of CPU saturation per parsed message, and doubling the nesting depth approximately quadruples the running time. An attacker can submit relatively small EML files that consume multiple seconds of processing time, causing worker latency, queue backpressure, and possible service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. This issue is fixed in version 3.0.2.
- Product
- eml_parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information.CVE-2026-55619 · Other software · GOVCERT-LU · reported by GitHubMedium 5.3
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.
- Product
- eml_parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information.CVE-2026-55618 · Other software · GOVCERT-LU · reported by GitHubMedium 6.5
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found_uri function in eml_parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. Valid encoded URLs and their host names are therefore rejected and omitted from the extracted URL and domain lists. Email security gateways and SOC pipelines that use those lists as indicators of compromise may fail to submit the hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. This issue is fixed in version 3.0.2.
- Product
- eml_parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model.CVE-2026-79660 · Other software · lin-snow · reported by VulnCheckMedium 6.9
Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.
- Product
- Ech0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 25, 2026The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize().CVE-2026-77138 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aCritical 9.3
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
- Product
- Extension "HTML5 Video Player vs. Powermail"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, witCVE-2026-77136 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aCritical 9.5
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.
- Product
- Extension "powermail"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction.CVE-2026-77129 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.7
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.
- Product
- Extension "Event management and registration"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes.CVE-2026-75575 · Other software · RocketChat · reported by VulnCheckMedium 6.9
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address that matches an account. With no DDPRateLimiter rule registered for it, a caller can drive an unbounded volume of reset mail at a chosen address from the deployment's own mail sender, and can probe addresses at scale: the method answers true for an address with no account and for a successful send, but false when the address belongs to an account that authenticates through an external provider and Accounts_AllowPasswordChangeForOAuthUsers is off, so repeated calls distinguish that class of account. Later versions register a rule permitting ten calls per minute per client address.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates.CVE-2026-75574 · Other software · getgrav · reported by VulnCheckHigh 8.7
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration.CVE-2026-72699 · Other software · getgrav · reported by VulnCheckCritical 9.3
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise. Because the registration endpoint has no rate limiting, an attacker can enumerate which email addresses have accounts on the site, one guess per request.
- Product
- grav-plugin-login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links.CVE-2026-56709 · Other software · getgrav · reported by VulnCheckHigh 8.7
Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 24, 2026Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.CVE-2026-78268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function.CVE-2026-71942 · Network & remote access · DrayTek Corporation · reported by VulnCheckHigh 8.6
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
- Product
- VigorSwitch G2540xs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddraytek.comvulncheck.com
Aug 24, 2026Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function.CVE-2026-71941 · Network & remote access · DrayTek Corporation · reported by VulnCheckHigh 8.6
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
- Product
- VigorSwitch G2540xs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddraytek.comvulncheck.com
Aug 24, 2026Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.CVE-2026-28153 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any acCVE-2026-76608 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller aCVE-2026-76597 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2026MC4WP: Mailchimp for: Stored Cross-Site ScriptingCVE-2026-4561 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'text_subscribed', 'text_error') in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MC4WP: Mailchimp for
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Mailgun for: Server-Side Request Forgery (SSRF)CVE-2026-78003 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passes them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
- Product
- Mailgun for
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Mailgun for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Firebase Authentication: Does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a sessionCVE-2026-76793 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.
- Product
- Firebase Authentication
- Fixed in
- 1.7.1
- What to do
- Update Firebase Authentication to 1.7.1 or newer.
Aug 21, 2026Limit Login Attempts Reloaded: Does not compare logins against its username denylist case-insensitively and does not account for the account's email addressCVE-2026-18356 · WordPress plugins & themes · reported by WPScanLow 3.7
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
- Product
- Limit Login Attempts Reloaded
- Fixed in
- 3.3.5
- What to do
- Update Limit Login Attempts Reloaded to 3.3.5 or newer.
Aug 20, 2026Mailpit is an email testing tool and API for developers.CVE-2026-67448 · Other software · axllent · reported by GitHubMedium 6.5
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mailpit is an email testing tool and API for developers.CVE-2026-67447 · Other software · axllent · reported by GitHubMedium 5.3
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mailu is a mail server as a set of Docker images.CVE-2026-49217 · Other software · Mailu · reported by GitHubHigh 7.5
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
- Product
- Mailu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.CVE-2026-77506 · Other software · Znuny · reported by MITREMedium 4.8
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
- Product
- Znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mailpit is an email testing tool and API for developers.CVE-2026-67446 · Other software · axllent · reported by GitHubMedium 5.3
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. The Thumbnail handler in server/apiv1/thumbnails.go obtains attachment bytes through storage.GetAttachmentPart(), accepts image/* content, and calls imaging.Decode() with AutoOrientation before imaging.Fill() scales the image to 180 by 120 pixels. A compact image declaring very large dimensions can therefore consume disproportionately large memory and CPU, and opening the message UI can trigger the same endpoint through server/ui-src/components/message/MessageAttachments.vue. This can degrade availability when an unauthenticated client can store the crafted attachment and reach the web API. This issue is fixed in version 1.30.4.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mailpit is an email testing tool and API for developers.CVE-2026-67445 · Other software · axllent · reported by GitHubMedium 5.3
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.
- Product
- mailpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality.CVE-2026-64964 · Other software · ATutor · reported by cvd@cert.plMedium 6.3
ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim's email inbox. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
- Product
- ATutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordatutor.github.iocert.pl
Aug 19, 2026IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due tCVE-2026-19875 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_idCVE-2026-75953 · Websites & servers · reported by security@joomla.orgHigh 7.5
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026User Verification by PickPlugins: Does not verify that a request to resend a verification email is authorized to act on the supplied userCVE-2026-14861 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.
- Product
- User Verification by PickPlugins
- Affected
- up to 2.0.47
- What to do
- Affects up to 2.0.47. Update User Verification by PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.4
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Aug 19, 2026An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.CVE-2026-70408 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpHigh 8.7
An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.CVE-2026-66358 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpMedium 5.1
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).CVE-2026-70931 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Workflow accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
- Product
- Oracle Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).CVE-2026-70927 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Workflow. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Oracle Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).CVE-2026-70926 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component).CVE-2026-62448 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Email Center accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Oracle Email Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).CVE-2026-60808 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing. While the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data as well as unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
- Product
- Siebel Apps - Marketing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage.CVE-2026-50167 · Other software · kurrier-org · reported by GitHubMedium 5.3
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
- Product
- kurrier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message cCVE-2026-75872 · Other software · maalfer · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 6.9
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.
- Product
- MailerUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'.CVE-2026-23922 · Other software · Zabbix · reported by security@zabbix.comLow 2.1
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create EvCVE-2026-50771 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.squirro.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.