Casdoor security vulnerability

Casdoor is an open-source platform developed by Casdoor that supports various authentication and authorization protocols. Versions of Casdoor prior to 2.362.0 contained security vulnerabilities. These vulnerabilities stemmed from unverified email binding issues, which could lead to account...

CVE-2026-4888: Missing Authorization

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

LinkAce injection vulnerability

LinkAce is a self-hosted repository developed by Kevin Woblick, designed to collect links to your favorite websites. Versions of LinkAce prior to 2.5.6 had an injection vulnerability. This vulnerability stemmed from the database configuration process allowing attackers to control databases by...

PT-2026-44369

Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services...

Mozilla Firefox Thunderbird Buffer Overflow

The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Mozilla Firefox Thunderbird Heap Buffer Overflow

The vulnerability of the Mozilla Firefox browser and the Thunderbird email client is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-4888 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

CVE-2026-4888

CVE-2026-4888 affects the Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder for WordPress. The vulnerability is due to a missing capability check in the send_test_email() function across all versions up to and including 3.4.7, allowing authenticated attackers with Sub...

CVE-2026-4888 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

CVE-2026-4888

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 3.4.7. This makes it possible for authenticated...

GHSA-VQC8-7275-Q272 Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Description Symfony\Component\Mime\Header\ParameterizedHeader and the related parameter handling reachable from Symfony\Component\Mime\Header\Headers is responsible for serializing structured headers such as Content-Type and Content-Disposition, which carry key=value parameters e.g...

CVE-2026-44707

Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover Pre-ATO vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not...

CVE-2026-45716 Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured the default for self-hosted Budibase instances,...

CVE-2026-45716

Budibase vulnerability CVE-2026-45716 affects the onboardUsers endpoint: when SMTP is not configured, POST /api/global/users/onboard allows a builder to create new global admin accounts by injecting attacker-controlled roles, returning the generated password in the response and enabling full priv...

CVE-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured the default for self-hosted Budibase instances,...

org.jenkinsci.plugins:emailext-template (>=0.1-beta, <=0.3) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.37.2.2)

org.jenkins-ci.plugins:email-ext MAVEN version 2.37.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =0.1-beta, =0.3 Source cves: CVE-2026-48920 Source...

org.jenkins-ci.plugins:email-ext-recipients-column (72.v546836954562), org.jenkinsci.plugins:emailext-template (233.v1eb_88fc160b_5) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1876.v28d8d38315b_d)

org.jenkins-ci.plugins:email-ext MAVEN version 1876.v28d8d38315bd is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkins-ci.plugins:email-ext-recipients-column 72.v546836954562 -...

org.jenkinsci.plugins:emailext-template (249.v81d6ea_f33f2e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version 1916.vc954af86ff21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 249.v81d6eaf33f2e Source cves:...

org.jenkinsci.plugins:emailext-template (0.4) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.40.3)

org.jenkins-ci.plugins:email-ext MAVEN version 2.40.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 0.4 Source cves: CVE-2026-48920 Source advisory:...

org.jenkins-ci.plugins:email-ext-recipients-column (1.0), org.jenkins-ci.plugins:job-direct-mail (>=1.1, <=1.5) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.25)

org.jenkins-ci.plugins:email-ext MAVEN version 2.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkins-ci.plugins:email-ext-recipients-column 1.0 - org.jenkins-ci.plugins:job-direct-mail...