CVE-2026-35407

Saleor’s CVE-2026-35407 describes a cross-account email-change weakness in the account email-change workflow. The confirmation token could be used for a different authenticated user, allowing the token’s new_email to update the second account’s address even though the token wasn’t issued for that...

EUVD-2026-20534

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given...

CVE-2026-35407 Saleor has Cross-Account Email Change via Unbound Confirmation Token

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given...

CVE-2026-35407 Saleor has Cross-Account Email Change via Unbound Confirmation Token

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given...

CVE-2025-14243

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

CVE-2025-14243 Mirror-registry: openshift mirror registry: user enumeration via authentication error messages

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

CVE-2025-14243

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation. Mitigation Mitigation for this issue is either not...

CRLF Injection

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to CRLF Injection via the name configuration configuration option. An attacker can inject arbitrary SMTP commands by supplying carriage return and...

@bitblit/ratchet-aws-node-only (>=6.1.196-alpha, <=6.1.200-alpha), @bitblit/ratchet-epsilon-common (>=6.1.196-alpha, <=6.1.200-alpha) +70 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.4)

nodemailer NPM version =8.0.0, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =3.35.0, =4.0.0-canary.13686, =4.0.0-canary.13686, =20.6.0, =5.0.10, =0.0.1-beta.0, =0.2.0-alpha.1, =0.19.1, =5.8.38, =5.8.40 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-15930946...

PT-2026-31329

Name of the Vulnerable Software and Affected Versions OpenShift Mirror Registry affected versions not specified Description A flaw exists in the OpenShift Mirror Registry that allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses through differing error...

PT-2026-31428

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's PO...

Saleor Authorization Issues Vulnerability

Saleor is an open-source interface software developed by Saleor Commerce. Versions of Saleor from 2.10.0 to 3.23.0a3, as well as versions before 3.22.47, 3.21.54, and 3.20.118, have issues with authorization vulnerabilities. These vulnerabilities stem from logical and authorization flaws in the...

WebGPU Component Code Execution

The vulnerability of the WebGPU component in the Mozilla Firefox browser and the Thunderbird email client is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-31392

Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the account email change workflow, the confirmation flow did not verify that the email change confirmation token was issued for the given...

Memory Corruption Vulnerability in Multiple Mozilla Products (CNVD-2026-16994)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A memory corruption vulnerability exists in multiple Mozilla products,...

CVE-2026-35400: Improper Link Resolution Before File Access

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's PO...

Saleor security vulnerabilities

Saleor is an open-source interface software developed by Saleor Commerce. Vulnerabilities exist in versions of Saleor before 3.23.0a3, as well as versions before 3.22.47, 3.21.54, and 3.20.118. These vulnerabilities stem from the exposure of users’ email addresses in error messages...

GitLab security vulnerabilities

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD continuous integration and delivery. There were security vulnerabilities in versions prior to GitLab 18.8.9,...

CVE-2025-9484: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries...

PT-2026-83730

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.5 Description An SMTP command injection issue exists in the transport name configuration option used in EHLO, HELO, and LHLO commands. The name parameter is concatenated directly into SMTP commands without...