cpython: email header injection due to unquoted newlines

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules,...

SUSE-SU-2026:20956-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting bsc1257181. - CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader bsc1259240...

EUVD-2026-17313

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-5180

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-5180 SourceCodester Simple Doctors Appointment System ajax.php sql injection

A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login2. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

email-master (0.6.2), hnzhu010506 (0.0.1) +2 more potentially affected by CVE-2026-34073 via cryptography (37.0.0)

cryptography PYPI version 37.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - email-master 0.6.2 - hnzhu010506 0.0.1 - hnzhu010507 =0.0.1, =0.0.8 - kadi 0.24.0 Source cves: CVE-2026-34073 Source advisory:...

RHEL 9 : python3.11 (RHSA-2026:6253)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6253 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

📄 FreeScout 1.8.206 Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution vulnerability in FreeScout versions less than or equal to 1.8.206 CVE-2026-28289. The sanitizeUploadedFileName function checks for dot-prefixed filenames before stripping Unicode format characters ZWSP U+200B, allowing...

PT-2026-29346

Name of the Vulnerable Software and Affected Versions SonicWall Email Security affected versions not specified Description A flaw exists in the SonicWall Email Security appliance related to insufficient input validation. This could result in data corruption, potentially allowing a remote attacker...

baserCMS security vulnerabilities

BaserCMS is a corporate-level content management system CMS developed by the baserCMS team. Versions of BaserCMS prior to 5.2.3 contained security vulnerabilities. These vulnerabilities stemmed from defects in the public email submission API, which could allow for bypassing management controls an...

PT-2026-29317

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.2.9 Description Discourse, an open-source discussion platform, had an issue where the group email settings test endpoint could be exploited to...

SourceCodester Simple Doctors Appointment System SQL Injection Vulnerability

SourceCodester Simple Doctors Appointment System is an easy doctor appointment system developed under the open-source framework of SourceCodester. Version 1.0 of the SourceCodester Simple Doctors Appointment System has a SQL injection vulnerability. This vulnerability arises from incorrect handli...

SonicWALL Email Security has a vulnerability related to input validation errors.

SonicWALL Email Security is an email security system developed by the American company SonicWALL. SonicWall Email Security has a vulnerability related to input validation. This vulnerability arises from improper input validation and could lead to denial-of-service attacks...

SonicWALL Email Security Cross-Site Script Vulnerabilities

SonicWALL Email Security is an email security system developed by the American company SonicWALL. SonicWALL Email Security has a cross-site scripting vulnerability, which stems from improper handling of user inputs during web page generation. This vulnerability may lead to stored cross-site...

SonicWALL Email Security has a vulnerability related to input validation errors.

SonicWALL Email Security is an email security system developed by the American company SonicWALL. SonicWall Email Security has a vulnerability related to input validation, which stems from improper input cleansing. This vulnerability may lead to data corruption...

PT-2026-29358

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, in versions 26.0 and prior, has an issue in the objects/emailAllUsers.json.php endpoint. This endpoint allows administrators to send HTML emails to all registered users. The...

Multiple Mozilla Products Code Issues Vulnerabilities

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code issue vulnerability exists in several Mozilla products that can b...

PT-2026-29423

Summary An unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 quoted local part yet contains raw HTML — for example "alert1"@evil.com. PHP's FILTER VALIDATE EMAIL accepts this email as valid. The email is stored in the database without...

WWBN AVideo Cross-Site Request Forgery Vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF token validation on the objects/emailAllUsers.json.php endpoint, whic...

PT-2026-29345

Name of the Vulnerable Software and Affected Versions SonicWall Email Security appliance affected versions not specified Description The SonicWall Email Security appliance contains a flaw related to improper input validation. A remote, authenticated attacker with admin privileges can exploit this...