CVE-2026-103496: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

Microsoft Disrupts AI-Powered EvilTokens Service Linked to 12,000 Hacked Inboxes

Microsoft disrupted EvilTokens after the AI-powered phishing service compromised 12,000 inboxes across 10,000 organisations and enabled complex financial fraud...

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

GHSA-8GR3-5J6F-25GP Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

EUVD-2026-84535

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

CVE-2026-75510

Novu's @novu/js In-App Inbox and @novu/react Inbox components (prior to version 3.18.0 ) are vulnerable to Stored XSS due to a lack of URL-scheme validation. An authenticated organization member or API-key holder can create a v1 in-app workflow with a call-to-action containing a javascript: redir...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-96788

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react Inbox component versions prior to 3.18.0 Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification...

CVE-2026-85177

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...

EUVD-2026-70481

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...

CVE-2026-85177

CRMEB through 6.0.0 is affected by an unauthorized message modification vulnerability in the edit_message handler of MessageSystemController.php. The root cause is a failure to validate message ownership , allowing any authenticated user to modify arbitrary system inbox messages. An attacker can ...

CVE-2026-85177 CRMEB through 6.0.0 Unauthorized Message Modification via edit_message

CRMEB through 6.0.0 fails to validate message ownership in the editmessage handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including isdel, look, and uid to delete, mark read, or reassign...

PT-2026-85036

CRMEB through 6.0.0 fails to validate message ownership in the edit message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is del, look, and uid to delete, mark read, or reassign...

CVE-2026-82808: Use of Hard-coded Credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-57495

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

CVE-2026-57495 AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

CVE-2026-58482

In Network-AI, the ApprovalInbox HTTP surface (lib/approval-inbox.ts) exposes state-changing endpoints POST /approvals/:id/approve and /deny without authentication and with Access-Control-Allow-Origin: * across all routes. This allows any reachable actor to enumerate and approve high-risk actions...

CVE-2026-58482

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...