CVE-2025-12895 Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kaliumvccontactformrequest function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to us...

PT-2026-3002

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium vc contact form request function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers t...

[SECURITY] Fedora 42 Update: coturn-4.7.0-4.fc42

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

[SECURITY] Fedora 43 Update: coturn-4.7.0-4.fc43

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

Malicious code in wac-relay-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6742f4abdd6851c0f1a4f003f84ac7dca306f8b29a0bf39ad8e41b12a9680d32 The package wac-relay-runtime was found to contain malicious code. Source: ghsa-malware...

MAL-2026-202 Malicious code in wac-relay-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6742f4abdd6851c0f1a4f003f84ac7dca306f8b29a0bf39ad8e41b12a9680d32 The package wac-relay-runtime was found to contain malicious code. Source: ghsa-malware...

CVE-2026-22032

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the RelayState parameter is intended to preserve the user's original...

CVE-2022-33993

Misinterpretation of special domain name characters in DNRD aka Domain Name Relay Daemon 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form...

CVE-2024-41960

mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scrip...

CVE-2024-41962

Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorizedkeys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10...

UAT-7290 targets high value telecommunications infrastructure in South Asia

Cisco Talos is disclosing a sophisticated threat actor we track as UAT-7290, who has been active since at least 2022. UAT-7290 is tasked with gaining initial access as well as conducting espionage focused intrusions against critical infrastructure entities in South Asia. UAT-7290's arsenal includ...

PT-2026-2139

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.0 Description Directus is a real-time API and App dashboard for managing SQL database content. An open redirect exists in the Directus SAML authentication callback endpoint. The RelayState parameter, intended t...

CVE-2025-61782 Open Redirect in OpenCTI's SAML Authentication Flow

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint /auth/saml/callback. By manipulating the RelayState parameter, an attacker can...

CVE-2025-61782

OpenCTI prior to version 6.8.3 contains an open redirect in the SAML callback endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can trigger a 302 redirect to an arbitrary external URL, enabling phishing and credential theft. Remediation: upgrade to version 6.8....

CVE-1999-0682

Microsoft Exchange 5.5 allows a remote attacker to relay email i.e. spam using encapsulated SMTP addresses, even if the anti-relaying features are enabled...

CVE-1999-0512

A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers...

CVE-2019-7097

Adobe Dreamweaver versions 19.0 and earlier have an insecure protocol implementation vulnerability. Successful exploitation could lead to sensitive data disclosure if smb request is subject to a relay attack...

CVE-2006-3416

Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded. NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS...

CVE-2025-1997

IBM UrbanCode Deploy UCD 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentiall...

Open Redirect

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Open Redirect via the RelayState parameter, which is used in redirects without proper validation against an allowlist of permitted domains. An attacker...