PT-2026-88866

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

CVE-2026-61908: Out-of-bounds Read

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H - , which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-75137

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79323

The Magefan Blog GraphQL for Magento 2 extension (magefan/module-blog-graph-ql ) version 2.2.1 and prior is vulnerable to an information disclosure flaw within the blogComments GraphQL query . A remote unauthenticated attacker can perform a POST request to the /graphql endpoint to obtain sensitiv...

PT-2026-89010

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-81741: URL Redirection to Untrusted Site

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

The vulnerability of the RoundCube Webmail email client, related to the unlimited distribution of resources, allows attackers to cause service failures.

The vulnerability of the RoundCube Webmail email client is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-86085

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict through normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled...

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

GHSA-WMMP-3585-3RMP Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

GHSA-CC9R-2J5M-2M83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

GHSA-2QH5-382H-3JPC CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-86722

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

EUVD-2026-72858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...