CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

PT-2026-107992

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccountService that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

PYSEC-2026-3398 Vantage6: 2FA can be circumvented with hacked email access

Impact If an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that most email providers require 2FA to access email, so this issue is not very likely to cause...

PT-2026-60010

Impact If an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that most email providers require 2FA to access email, so this issue is not very likely to cause...

EUVD-2000-0396

Malware in sbrugna...

EUVD-2002-1717

Malware in sbrugna...

EUVD-2017-9786

Malware in sbrugna...

EUVD-2018-13589

Malware in sbrugna...

EUVD-2019-5870

Malware in sbrugna...

EUVD-2020-3817

Malware in sbrugna...

EUVD-2011-0703

Malware in sbrugna...

EUVD-2021-8784

Malicious code in bioql PyPI...

EUVD-2022-46681

Malicious code in bioql PyPI...

EUVD-2022-51667

Malicious code in bioql PyPI...

EUVD-2024-45922

Malicious code in bioql PyPI...

Google Warns Salesloft Drift Breach Impacts All Drift Integrations Beyond Salesforce

Google has revealed that the recent wave of attacks targeting Salesforce instances via Salesloft Drift is much broader in scope than previously thought, stating it impacts all integrations. "We now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or...

CVE-2022-43699

OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain found in the host part of an e-mail address...

CVE-2019-14723

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account...

CVE-2018-20934

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts SEC-411...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email accou...