CVE-2026-76461: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

VulnCheck KEV: CVE-2026-76461

Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...

PT-2026-91210

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...

PT-2026-91269

The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's...

CVE-2026-76443: Improper Neutralization

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple...

PT-2026-91268

The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's...

CVE-2026-20353: Improper Control of a Resource Through its Lifetime

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple...

CVE-2026-90934: Incorrect Authorization

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

CVE-2026-90776

A flaw was found in Nodemailer's addressparser component. A remote attacker can exploit this by crafting malicious email headers containing specially formatted comments. This can lead to excessive CPU consumption and block the Node.js event loop, resulting in a denial of service for the...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 are affected by a quadratic time complexity flaw in the addressparser component. When parsing email addresses containing RFC 5322 comments (comment-separated atoms), the parser consumes excessive CPU and blocks the Node.js event loop for several seconds, r...

CVE-2026-90513

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

CVE-2026-90513 simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

CVE-2026-90513 simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

CVE-2026-90513

CVE-2026-90513 affects simalexan api-lambda-send-email-ses (up to commit bda6869aa81371d1e872242e74fe7d953edb818d ). The flaw resides in the SES.sendEmail function within the API Gateway Endpoint component (file template.yml ), where a missing authentication mechanism allows remote manipulation o...

EUVD-2026-76985

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument...

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending...

EUVD-2026-76959

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

CVE-2026-89080

The Really Simple Security WordPress plugin versions prior to 9.8.1 contains a vulnerability that fails to block unauthenticated requests intended to reset an account's completed email two-factor enrollment. An attacker who possesses a user's password can exploit this flaw to bypass the second fa...