CVE-2026-48780 Forem vulnerable to bypass of email address domain restrictions

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

Regular Expression Denial of Service (ReDoS)

Overview bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the LinkifyFilter.handleemailaddresses function. An attacker can cause excessive CPU...

Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parseemail=True. The implementation scans attacker-controlled text with EMAILRE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...

GHSA-G75F-G53V-794X Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parseemail=True. The implementation scans attacker-controlled text with EMAILRE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...

BIT-DISCOURSE-2026-44784 Discourse: Non-staff group owners can see email password in plaintext through group history

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history...

BIT-DISCOURSE-2026-44780 Discourse: Category queue reviewers can read raw incoming emails from queued posts

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload"rawemail" for posts that arrived via incoming email. Category moderation group...

Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware

The North Korean state-sponsored hacking group known as ScarCruft aka APT37 has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver a new malware called NarwhalRAT. "The attack email contained a message impersonating an MS account security...

PT-2026-52868

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parse email=True. The implementation scans attacker-controlled text with EMAIL RE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...

CVE-2026-48780: Improper Authentication

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

PT-2026-49717

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of a2ab6d4. As a workaround,...

EUVD-2026-36960

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

EUVD-2026-36747

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

CVE-2026-42668

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...

CVE-2026-39530

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

CVE-2026-42668

CVE-2026-42668 affects WordPress plugin Email Marketing for WooCommerce by Omnisend (versions

EUVD-2026-36833

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...

CVE-2026-39530 WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

CVE-2026-39530

CVE-2026-39530 involves the WordPress plugin SpeakOut! Email Petitions, affecting versions

CVE-2026-39530 WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342526...