org.jenkinsci.plugins:emailext-template (>=1.0, <=1.1) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.43)

org.jenkins-ci.plugins:email-ext MAVEN version 2.43 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template =1.0, =1.1 Source cves: CVE-2026-48920 Source advisory:...

GHSA-MQ58-M26G-46GP Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined. This allows attackers able to control the email content t...

org.jenkins-ci.plugins:cisco-spark (>=1.1.0, <=1.1.1) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.41)

org.jenkins-ci.plugins:email-ext MAVEN version 2.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkins-ci.plugins:cisco-spark =1.1.0, =1.1.1 Source cves: CVE-2026-48920 Source advisory:...

org.jenkinsci.plugins:emailext-template (0.4) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (2.40.3)

org.jenkins-ci.plugins:email-ext MAVEN version 2.40.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 0.4 Source cves: CVE-2026-48920 Source advisory:...

Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier includes a feature that allows inlining images as base64 in email content by setting the data-inline attribute. No restrictions are placed on the image URLs that can be inlined. This allows attackers able to control the email content t...

org.jenkinsci.plugins:emailext-template (249.v81d6ea_f33f2e) potentially affected by CVE-2026-48920 via org.jenkins-ci.plugins:email-ext (1916.vc954a_f86ff21)

org.jenkins-ci.plugins:email-ext MAVEN version 1916.vc954af86ff21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:email-ext and may be impacted: - org.jenkinsci.plugins:emailext-template 249.v81d6eaf33f2e Source cves:...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

EUVD-2026-32511

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

CVE-2026-48920

The Jenkins Email Extension Plugin versions 1933.v45cec755423f and earlier are vulnerable to an arbitrary file read flaw. The plugin allows inlining images as base64 in email content via the data-inline attribute but lacks restrictions on the image URLs provided. Attackers capable of controlling ...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

CVE-2026-48920

Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as base64 in email content by setting the data-inline attribute, without restrictions on the image URLs that can be inlined, allowing attackers able to control the email content to specify file: URLs for images t...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Email Sending vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin Everest Forms versions = 3.4.7...

SUSE CVE-2026-48846

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...

Company bragged phone mics could listen to conversations. They couldn&#8217;t.

A media company and two of its marketing partners have been fined for selling a service which, they said, listened in to people's conversations through their phones. Actually they did nothing of the sort. Most people have worried at some point that their phone has been listening to them through t...

CVE-2026-8787

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...

CVE-2026-8048

The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in all versions up to, and including, 0.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...

CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...