EUVD-2026-46122

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-64619

FileCodeBox prior to 2.4 is affected by a rate-limit bypass in the IPRateLimit component. An unauthenticated attacker can spoof X-Real-IP and X-Forwarded-For headers without verifying the trusted reverse proxy origin, sending unique IP values per request to enumerate all share codes and access ot...

EUVD-2026-46069

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers...

CVE-2026-45295

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

Exploit for CVE-2026-44680

CVE-2026-44680-MikroORM-SQL-Injection-Exploit-Framework PoC to...

CVE-2026-45295 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-45295 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-45295

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-45295 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-45295

FreeScout (PHP/Laravel) before version 1.8.219 is vulnerable via the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id}, allowing unauthenticated users to enumerate valid conversation and thread IDs and to modify the thread’s opened_at timestamp. The issue is fixed in 1.8.219. ...

EUVD-2026-46043

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-42218

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

CVE-2026-32819

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

CVE-2026-42218

CVE-2026-42218 affects xrdp, an open source RDP server. The issue is a timing side‑channel in the login interface of versions 0.10.6 and earlier that allows remote observers to infer whether a username exists, enabling information disclosure via username enumeration. The vulnerability is explicit...

CVE-2026-42218 XRDP is vulnerable to a server timing attack, leading to user enumeration

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

EUVD-2026-46024

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

CVE-2026-42218

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

CVE-2026-42218 XRDP is vulnerable to a server timing attack, leading to user enumeration

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

CVE-2026-42218 XRDP is vulnerable to a server timing attack, leading to user enumeration

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...