CVE-2026-47164 Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP emailverified claim only for new-user creation and not when SSOSIGNUPSMATCHEMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled Id...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

An update for golang-github-openstack-k8s-operators-os-diff is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

Malicious code in gmail-changer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913e56ded5b9c46e15c7589a0883bfb708b2488aa54f4c25ca05b1c13e4d75fe Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers waitForRemoveRecovery, waitForRecoveryAdd...

The vulnerability affects the implementation of the WebRTC technology in Mozilla Firefox ESR and Thunderbird email client, allowing a hacker to execute arbitrary code.

The vulnerability in the implementation of the WebRTC technology in Mozilla Firefox ESR and the Thunderbird email client is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-60204

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.36.0 Description The SSO login flow fails to verify the email verified claim from the Identity Provider IdP when the SSO SIGNUPS MATCH EMAIL variable is set to true during the linking of an IdP identity to an...

OpenSSL X.509 Email Validation Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of expected X.509 email names. The issue results from the lack of proper...

MIMEDefang Email Scanner 3.71

MIMEDefang is a flexible MIME email scanner designed to protect Windows clients from viruses. Includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. It can alter or delete various parts of a MIME message according to a very flexible...

CVE-2026-45063

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $SERVER'SSLCLIENTSDN' with an unanchored regex that matches emailAddress= anywhere in the distinguishe...