EUVD-2026-36747

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote...

CVE-2026-42668

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...

CVE-2026-39530

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

EUVD-2026-36833

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...

CVE-2026-42668

CVE-2026-42668 affects WordPress plugin Email Marketing for WooCommerce by Omnisend (versions

CVE-2026-39530

CVE-2026-39530 involves the WordPress plugin SpeakOut! Email Petitions, affecting versions

CVE-2026-39530 WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +316 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342526...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +316 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-268H-HP4C-CRQ3...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +316 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WQVQ-JVPQ-H66F...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +315 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.7)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R7G4-QG5F-QQM2...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +315 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.7)

nodemailer NPM version =8.0.0, =1.0.0, =0.12.2, =0.5.3, =0.4.1, =2.0.2, =3.19.2, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =1.0.0, =2.4.0, =2.1.108, =0.0.1, =0.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342524...

Microsoft Defender email security benchmarking: Key insights from one year of data

Microsoft publishes quarterly email security benchmarking data comparing Microsoft Defender against secure email gateway SEG and integrated cloud email security ICES vendors using real-world threat telemetry. A year ago, we set out to change how email security effectiveness is measured. With our...

CVE-2026-49757

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...

The Onboarding Password Mistake That Creates Unnecessary Risk

Employee onboarding is a busy time for IT teams. New starters need devices, accounts, access permissions, and passwords, all delivered within a tight timeframe. That usually means sharing a temporary "first-day" password so employees can access systems for the first time. The issue is that these...

EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Summary Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined...

CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...

CVE-2026-49757

AshAuthentication (versions before 4.14.0 and before 5.0.0-rc.10) is vulnerable to an authentication bypass where OAuth2/OIDC sign-in matches local users by email rather than the issuer/sub identity. An attacker able to provide a victim’s email to an OAuth provider could be signed in to the victi...

CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...

CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...