57449 matches found
CVE-2026-39530
CVE-2026-39530 involves the WordPress plugin SpeakOut! Email Petitions, affecting versions
CVE-2026-39530 WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342526...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by CVE-2026-82661 via nodemailer (>=8.0.0, <=8.0.8)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: CVE-2026-82661 Source advisory: OSV:GHSA-268H-HP4C-CRQ3...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by CVE-2026-82660 via nodemailer (>=8.0.0, <=8.0.8)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: CVE-2026-82660 Source advisory: OSV:GHSA-WQVQ-JVPQ-H66F...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +138 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.7)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342524...
@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +138 more potentially affected by CVE-2026-82662 via nodemailer (>=8.0.0, <=8.0.7)
nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: CVE-2026-82662 Source advisory: OSV:GHSA-R7G4-QG5F-QQM2...
Microsoft Defender email security benchmarking: Key insights from one year of data
Microsoft publishes quarterly email security benchmarking data comparing Microsoft Defender against secure email gateway SEG and integrated cloud email security ICES vendors using real-world threat telemetry. A year ago, we set out to change how email security effectiveness is measured. With our...
Microsoft Defender email security benchmarking: Key insights from one year of data
Microsoft publishes quarterly email security benchmarking data comparing Microsoft Defender against secure email gateway SEG and integrated cloud email security ICES vendors using real-world threat telemetry. A year ago, we set out to change how email security effectiveness is measured. With our...
CVE-2026-49757
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...
The Onboarding Password Mistake That Creates Unnecessary Risk
Employee onboarding is a busy time for IT teams. New starters need devices, accounts, access permissions, and passwords, all delivered within a tight timeframe. That usually means sharing a temporary "first-day" password so employees can access systems for the first time. The issue is that these...
CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...
EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Summary Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined...
CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...
CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...
CVE-2026-49757
AshAuthentication (versions before 4.14.0 and before 5.0.0-rc.10) is vulnerable to an authentication bypass where OAuth2/OIDC sign-in matches local users by email rather than the issuer/sub identity. An attacker able to provide a victim’s email to an OAuth provider could be signed in to the victi...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
CVE-2026-36537
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...
