CVE-2026-74999

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

CVE-2026-74999

Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 is affected by a stored XSS in the "Add to address book" action. An authenticated attacker can inject malicious script that executes in the context of another user's session when they interact with the crafted address book entry. The CVSS 3.1...

CVE-2026-74999

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

CVE-2026-74999

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

CVE-2026-74999

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

A flaw was found in OpenSSL. When an application uses the X509VERIFYPARAMset1email function to validate a specially crafted S/MIME Secure/Multipurpose Internet Mail Extensions email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious...

CVE-2026-19998

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability

Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...

CVE-2026-19998 code-projects Online Shopping System offersmail.php cross site scripting

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

CVE-2026-19998

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100885)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100885 advisory. A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, ev...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101105)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101105 advisory. Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header...

PT-2026-76743

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101332)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101332 advisory. Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email...

PT-2026-76640

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

PT-2026-76647

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099473 advisory. An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a...

PT-2026-73219

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote cross site scripting issue exists in the offersmail.php file. This occurs when the email argument is manipulated, allowing an attacker to execute malicious scripts in the...