EUVD-2026-70210

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20354

CVE-2026-20354 affects the S/MIME decryption functionality of Cisco Secure Email . The root cause is insufficient validation of message integrity , allowing an unauthenticated remote attacker to use a man-in-the-middle technique to intercept and modify traffic between email gateways. A successful...

CVE-2026-20354 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2025-15481

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

EUVD-2025-210829

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

SUSE CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

SUSE CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

CVE-2026-84799

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relation fields including author , authors , uploader , draftCreator , and revisionCreator . An attacker holding a scoped GraphQL token can query these relations to read the usernames, email addresses, and fu...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-79621

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

EUVD-2026-69845

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621

The CatalogX WordPress plugin (versions before 6.1.3 ) is vulnerable to an Unauthenticated Email Content Injection due to a lack of proper sanitization and escaping of user-supplied content. An unauthenticated attacker can store malicious content that is later included in product enquiry notifica...

WordPress CatalogX plugin < 6.1.3 - Unauthenticated Email Content Injection vulnerability

Unauthenticated Email Content Injection vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions 6.1.3...

CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

CVE-2026-82968 Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...