zimbra-cve-2026-73570-ir

Zimbra CVE-2026-73570 Community IR Toolkit Detection-first, evidence-preserving incident-response helpers for Zimbra administrators investigating suspected exploitation of CVE-2026-73570. !CAUTION This is an independent community project, not a vendor compromise oracle. The checker is read-only a...

CVE-2026-73570

CVE-2026-73570 PoC - SMTP Command Injection Tester A custom, low-level Python proof-of-concept PoC script for testing SMTP command injection vulnerabilities CVE-2026-73570. This tool sends a malformed RCPT TO address containing shell-style command substitution e.g., $command to determine if the...

EUVD-2026-123837

A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command...

CVE-2026-126163

A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command...

CVE-2026-126163

A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command...

CVE-2026-126163

Fortinet FortiMail versions 8.0.0 through 8.0.1 are vulnerable to a use of externally-controlled format string [CWE-134]. This flaw allows a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted SMTP command . Exploitation of this vulnerability co...

CVE-2026-126163: Fortinet FortiMail: A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote…

A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command...

PT-2026-145494

Name of the Vulnerable Software and Affected Versions Fortinet FortiMail versions 8.0.0 through 8.0.1 Description A format string vulnerability occurs when an application uses externally-controlled input as a format string, which can lead to memory corruption or unauthorized code execution. A...

Use of externally-controlled format string

A Use of Externally-Controlled Format String CWE-134 in FortiMail may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command...

Security Bulletin:Multiple vulnerabilities in netty-codec-smtp may affect IBM Infosphere Change Data Capture (CVE-2026-93563, CVE-2026-93576)

Summary Multiple security vulnerabilities have been identified in netty-codec-smtp, Netty/Codec/SMTP. netty-codec-smtp is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

CVE-2026-115785

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

EUVD-2026-109079

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785 Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address

An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite ZCS allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a...

CVE-2026-115785

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.20 are vulnerable to an SMTP command injection vulnerability within the data-source testing functionality. An authenticated user with account options enabled can perform a JSON SOAP request to inject CR/LF sequences into the emailAddr...

phpBB -- multiple vulnerabilities

The phpBB Team reports: Resend rate limiting incorrectly updating expiration time SECURITY-298 Attachment comment hijacking by other users SECURITY-300 Reflected XSS via data passed to registration page SECURITY-301, CVE-2026-87901 Hide oauth provider secrets in ACP SECURITY-302 Potential stored...

PT-2026-122107

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite ZCS version 10.1.16 Zimbra Collaboration Suite ZCS version 10.1.20 Description An SMTP command injection issue exists in the data-source testing functionality. An authenticated user with account options enabled can...

Astra Linux – vulnerability in Symfony

Description Symfony\Component\Mime\Address is the value-object through which every Symfony Mailer address to/cc/bcc/from/reply-to flows; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts...