CVE-2026-67249 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

EUVD-2026-104156

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

CVE-2026-91831

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

EUVD-2026-104101

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

WordPress Subscribe to Comments plugin < 2.3.3 - Author+ Email Header Injection vulnerability

Author+ Email Header Injection vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

CVE-2026-91831

The Subscribe to Comments WordPress plugin versions before 2.3.3 is vulnerable to an Email Header Injection flaw. The application fails to sanitize newline characters in the notification sender-name setting before utilizing them in email headers. This allows users with Author-level access or high...

PT-2026-118062

Vikunja: OIDC email-fallback account linking ignores email verified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-117251

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

PT-2026-117313

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

CVE-2026-112775: Improper Authentication

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

CVE-2026-112287: Authorization Bypass Through User-Controlled Key

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

PT-2026-118243

Name of the Vulnerable Software and Affected Versions EventON - Subscriber versions prior to 1.4.6 Description An unauthenticated attacker can perform a generic SQL Injection by appending additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied data and a...

PT-2026-118053

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2026-91831: Improper Neutralization of CRLF Sequences

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

PT-2026-117626

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the...

PT-2026-117431

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

Exploit for CVE-2026-104736

CVE-2026-104736 — LearnPress PHP object injection !PoCbit...

Progressive Robot hMailServer Trust Management Vulnerability

The Progressive Robot hMailServer from version 6.0.0 to 6.3.6 has a trust management vulnerability. This vulnerability stems from the use of DKIM signatures from an unreliable source. During the first delivery, the server does not verify the sender’s identity and signs the emails based on the...