58246 matches found
PT-2026-29345
Name of the Vulnerable Software and Affected Versions SonicWall Email Security appliance affected versions not specified Description The SonicWall Email Security appliance contains a flaw related to improper input validation. A remote, authenticated attacker with admin privileges can exploit this...
SonicWALL Email Security has a vulnerability related to input validation errors.
SonicWALL Email Security is an email security system developed by the American company SonicWALL. SonicWall Email Security has a vulnerability related to input validation. This vulnerability arises from improper input validation and could lead to denial-of-service attacks...
CVE-2026-3469: Improper Input Validation
A denial-of-service DoS vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive...
CVE-2026-3468: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code...
PT-2026-29358
Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, in versions 26.0 and prior, has an issue in the objects/emailAllUsers.json.php endpoint. This endpoint allows administrators to send HTML emails to all registered users. The...
CVE-2026-34611: Cross-Site Request Forgery (CSRF)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token...
CVE-2026-33185: Server-Side Request Forgery (SSRF)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts a...
WWBN AVideo Cross-Site Request Forgery Vulnerability
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF token validation on the objects/emailAllUsers.json.php endpoint, whic...
📄 FreeScout 1.8.206 Remote Code Execution
This Metasploit module exploits an unauthenticated remote code execution vulnerability in FreeScout versions less than or equal to 1.8.206 CVE-2026-28289. The sanitizeUploadedFileName function checks for dot-prefixed filenames before stripping Unicode format characters ZWSP U+200B, allowing...
PT-2026-29317
Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.2.9 Description Discourse, an open-source discussion platform, had an issue where the group email settings test endpoint could be exploited to...
SonicWALL Email Security Cross-Site Script Vulnerabilities
SonicWALL Email Security is an email security system developed by the American company SonicWALL. SonicWALL Email Security has a cross-site scripting vulnerability, which stems from improper handling of user inputs during web page generation. This vulnerability may lead to stored cross-site...
PT-2026-29344
Name of the Vulnerable Software and Affected Versions SonicWall Email Security affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the SonicWall Email Security appliance. This is due to insufficient sanitization of user-provided data when creating web...
PT-2026-29423
Summary An unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 quoted local part yet contains raw HTML — for example "alert1"@evil.com. PHP's FILTER VALIDATE EMAIL accepts this email as valid. The email is stored in the database without...
SourceCodester Simple Doctors Appointment System SQL Injection Vulnerability
SourceCodester Simple Doctors Appointment System is an easy doctor appointment system developed under the open-source framework of SourceCodester. Version 1.0 of the SourceCodester Simple Doctors Appointment System has a SQL injection vulnerability. This vulnerability arises from incorrect handli...
CVE-2026-3470: Improper Input Validation
A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database...
Multiple Mozilla Products Code Issues Vulnerabilities
Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code issue vulnerability exists in several Mozilla products that can b...
Mozilla Thunderbird Spoofing Vulnerability (CNVD-2026-16380)
Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A spoofing vulnerability exists in Mozilla Thunderbird, which can be exploited by attacke...
RHEL 9 : python3.11 (RHSA-2026:6253)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6253 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
CVE-2026-28228
OpenOLAT SAS/Velocity SSTI vulnerability (CVE-2026-28228) allows an authenticated author to inject Velocity directives into a reminder email; when processed, directives are evaluated server-side via Velocity #set chained with Java reflection, enabling arbitrary Java class execution (e.g., Process...
