grafana security update

9.2.10-35.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-35 - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION - Resolves RHEL-253157 9.2.10-34 - CVE-2026-42504 grafana: Golang MIME: Denial o...

Cisco Secure Email Gateway Advanced Malware Protection Privilege Escalation

The vulnerability of the Advanced Malware Protection module of the Cisco Secure Email Gateway protection tool is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files and execute...

PT-2026-114775

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-122752

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only...

PT-2026-114964

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is...

CVE-2026-59994: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and...

CVE-2026-77460: Authorization Bypass Through User-Controlled Key

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is...

CVE-2026-103304: Missing Authorization

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-55872: Improper Neutralization of Input During Web Page Generation

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

PT-2026-114962

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.9 Description An unauthenticated remote attacker can send an email to a monitored group or IMAP address, such as an email-to-Case address, containing arbitrary HTML within the plain-text body. The application stor...

PT-2026-114961

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...

CVE-2026-55184: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...

CVE-2026-81534: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Email Customizer for WooCommerce Pro plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the sendtestmail function, which allows user-controlled PHP code to be written to...

PT-2026-114785

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

Cisco Secure Email Gateway 16.0 AMP Arbitrary File Write

Cisco Secure Email Gateway versions 13.0 through 16.0 prior to Content Scanner Tools package 25.3.0.5525 contain a relative path traversal vulnerability in AMP File Reputation attachment handling that allows unauthenticated arbitrary file write...

CVE-2026-110854

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password rese...

CVE-2026-110870

A flaw was found in Nodemailer. A remote attacker can bypass domain allow-lists or cause email delivery failures by submitting specially crafted recipient addresses. Because the address parser fails to properly strip parenthesized comments within formatted email addresses, unvalidated characters...

CVE-2026-110871

A flaw was found in nodemailer. A remote attacker can trigger a Denial of Service DoS by submitting emails containing excessively long headers or large recipient lists that fold into numerous continuation lines. Inefficient header parsing in the message parser component leads to excessive CPU...

CVE-2026-110854 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password rese...

CVE-2026-110854 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password rese...