CLEANSTART-2026-QK41185 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-EL50504 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

CVE-2026-27137 affects multiple packages. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint wil...

VulnCheck KEV: CVE-2026-112353

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

PT-2026-127204

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was...

PT-2026-126383

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

PT-2026-126661

Name of the Vulnerable Software and Affected Versions GFI KerioConnect versions prior to 10.0.8 Patch 2 Description A stored cross-site scripting XSS flaw exists in the Webmail component. A remote attacker can execute JavaScript within a victim's authenticated session by uploading a specially...

CVE-2026-112500

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature...

CVE-2026-112500

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature...

CVE-2026-112500

A logic issue in the Hide My Email feature across multiple Apple platforms may cause a user's original email address to be leaked . The vulnerability affects iOS , iPadOS , macOS Golden Gate , and visionOS . This issue has been addressed with improved restrictions in versions 27.2 of these operat...

EUVD-2026-110262

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature...

stego_provenance_defense

Decode-Time Provenance Binding for MCP Agents A reproducible proof-of-concept for a steganographic prompt-injection vector that defeats text content scanners, and a defense that contains it at the decode boundary — decode-time provenance binding. Educational / defensive security research only. Al...

fake-mailer

Fake Mailer + Disclaimer : Fake Mailer is tool to Send Mail Anonymously from a different Email.This process can take upto 5 mins. This tool is created for Educational Purpose Only !! I am not responsible for any Misuse of this tool !! Installation : apt update apt install git python2 -y git clone...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Adobe Commerce

CVE-2026-75650 -- "StyleSmuggler" unauthenticated RCE in Magen...

GitLab - Account Takeover via Password Reset

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

PT-2026-125192

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature...

pocs

PoCs Proof-of-concept exploits from our security resear...

K000163883: JetBrains TeamCity vulnerability CVE-2025-57733

Security Advisory Description In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content CVE-2025-57733 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the...

InfoLeak-Scanner

InfoLeak-Scanner Docker First run docker run --rm -p 8000:80 siwecos/infoleak-scanner. Open your browser and use the scanner: http://localhost/?url= Install Get php5, curl and a webserver: sudo apt-get install apache2 php5 php5-curl Copy application into webserver: cp -R . /var/www/html/ What?...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC...