CVE-2026-63205

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies th...

CVE-2026-61855

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

SpamChannel

SpamChannel Live worker hosted at https://spamchannel.haxxx.workers.dev UPDATE Aug 13 2023: Two days after my DEFCON 31 talk, MailChannels silently decided to require aDomain Lockdown Record in order to send emails from Cloudflare Workers meaning this code doesn't work anymore. However, because...

CVE-2026-61855

The open source helpdesk system Zammad versions 7.0.3 and 7.1.1 is vulnerable to an issue where inbound PGP-signed emails may be incorrectly marked with a valid ("Good" ) signature status. This occurs under certain conditions because the verification process can identify a valid signature from a ...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465

The open source helpdesk system Zammad is vulnerable to sender impersonation in versions prior to 7.1.2 . The root cause is that the system fails to verify if an S/MIME-signed email's certificate is genuinely trusted; instead, it only checks if a certificate with a matching name exists in the sys...

CVE-2026-56727

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

EUVD-2026-87258

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63205

In Zammad versions prior to 7.1.2 , a vulnerability exists where users with specific channel admin permissions can access unauthorized attachments. When creating or updating an email signature, the system processes inline images; if an HTML img tag points to an existing attachment, Zammad copies ...

EUVD-2026-87255

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and...

CVE-2026-97063

The X-SpringBoot framework, versions through 6.0 , is vulnerable to an authentication bypass due to the exposure of login verification codes. The application returns these codes directly in HTTP responses from unauthenticated endpoints, specifically GET /sys/mobile/code and GET /sys/email/code , ...

metagoofil

Metagoofil 2.2 Coded by Christian Martorella www.edge-security.com [email protected] What is this? Metagoofil is a tool for extracting metadata of public documents pdf,doc,xls,ppt,etc availables in the target websites.This information could be useful because you can get valid usernames, peop...

henkaku

Build Only Linux is supported. You will need: Python 3 Vita SDK Uglify JS Ubuntu 16.04 package node-uglify tested version 2.4.15 Other standard tools that you should already have installed, such as openssl, dd, cat, touch All tools should be in your PATH. Run ./build.sh to build everything. This...

EUVD-2026-87214

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727

The open-source helpdesk system Zammad is vulnerable to PGP signature spoofing prior to version 7.0.2 . The root cause is that the system silently discards the return value of the gpg verification call during inbound PGP email processing. Consequently, the handler unconditionally writes a success...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

GHSA-G7VJ-C29H-3H5M FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

EUVD-2026-87140

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...