CVE-2026-34975

CVE-2026-34975 — 通过原始 MIME 构造在 Plunk 中实现 CRLF 邮件头注入 严重性 ：高（CVSS 8.5） CWE ：CWE-93 — CRLF 序列中和不当（'CRLF 注入'） 受影响范围 ：useplunk/plunk（修复前的所有版本） 安全公告 ：GHSA NVD ：https://nvd.nist.gov/vuln/detail/CVE-2026-34975 TL;DR Plunk 的 POST /v1/send 端点通过将用户提供的字段（from.name、subject、自定义邮件头、附件文件名）直接插入模板字符串来构造原始 MIME...

CVE-2026-42879

CVE-2026-42879 - FacturaScripts - 通过 MIME 类型绕过实现已认证的不受限制文件上传 摘要 FacturaScripts 的产品图片上传功能中存在一个已认证的不受限制文件上传漏洞。拥有有效凭据的攻击者可以上传伪装成 GIF 图片（使用 GIF89a 文件头）的 PHP 文件，从而绕过 MIME 类型验证。该文件会以其原始扩展名存储，包括 .php 等可执行扩展名。 详细信息 该漏洞存在于： Core/Lib/ExtendedController/ProductImagesTrait.php 具体位于 addImageAction 方法中。 漏洞代码...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability in its TinyMCE image upload endpoint . Due to missing file extension and MIME type validation, authenticated administrators can upload arbitrary PHP files to the public storage disk, achieving remote code execution by accessi...

CVE-2026-20355

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20354

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

flanker

Flanker - análisis de direcciones de correo electrónico y MIME para Python .. image:: https://travis-ci.org/mailgun/flanker.svg?branch=master :target: https://travis-ci.org/mailgun/flanker .. image:: https://coveralls.io/repos/github/mailgun/flanker/badge.svg?branch=master :target:...

CVE-2026-20355 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

EUVD-2026-70211

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20355

CVE-2026-20355 affects the S/MIME decryption functionality of Cisco Secure Email . The root cause is insufficient validation of message integrity , allowing an unauthenticated, remote attacker to use a machine-in-the-middle technique to intercept and modify traffic between email gateways and reco...

EUVD-2026-70210

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20354

CVE-2026-20354 affects the S/MIME decryption functionality of Cisco Secure Email . The root cause is insufficient validation of message integrity , allowing an unauthenticated remote attacker to use a man-in-the-middle technique to intercept and modify traffic between email gateways. A successful...

CVE-2026-20354 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP 上传 RCE 自动利用 Krayin CRM ≤ 2.2.x 的漏洞。此脚本利用 TinyMCE 端点（/admin/tinymce/upload）中的无限制文件上传漏洞，通过伪造 image/jpeg 绕过 MIME 类型验证，上传 PHP webshell，并以 Web 服务器权限执行任意命令。 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2026-38526 受影响软件| Krayin CRM ≤ 2.2.x 漏洞类型| 无限制文件上传 → 远程代码执行 认证| 必需（任意有效管理员账户） 端点|...

EUVD-2026-68891

Sulu: Stored XSS via media download inline-disposition override...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 未授权任意文件上传 研究方： Atomic Edge 严重程度： 严重 | CVSS： 9.8 | 需认证： 否 ⚠️ v2 — 已根据社区反馈进行技术修正。 详情请参见更新日志。 概述 BookingPress Pro WordPress 插件（版本 ≤ 5.6）中存在一个严重的未授权任意文件上传漏洞。预约提交处理器 bookingpressbookappointmentbooking 将签名字段值作为 data URI 处理。插件通过正则表达式从 URI 的 MIME...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

Important: Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

An update for golang-github-openprinting-ipp-usb is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...