org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers

A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of...

CVE-2026-28182

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

EUVD-2026-57961

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28182 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28181

CVE-2026-28181 concerns the WordPress AcyMailing SMTP Newsletter plugin, affected in versions up to 10.11.1. The issue is described as a Broken Access Control vulnerability, enabling unauthorized access to certain resources due to insufficient access restrictions. Based on the provided metrics, t...

CVE-2026-28181 WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-28181

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

EUVD-2026-57960

Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...

Input Validation Vulnerability

Apache Camel Mail Component is vulnerable to Improper Input Validation and Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to the MailProducer accepting attacker-controlled mail.smtp. and mail.smtps. headers, allowing untrusted input to override mail session...

PT-2026-71676

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 10.1.20 Description An OS command injection flaw exists in the SNMP monitoring functionality of the Zimbra Collaboration Suite. The issue occurs when the optional zimbra-snmp package is installed,...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

Summary IBM i is vulnerable to multiple vulnerabilites CVE-2026-18077, CVE-2026-16815, CVE-2026-16692 in Simple Mail Transfer Protocol SMTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18077 DESCRIPTION: IBM i could allow a remote attacker to cause a...

CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

EUVD-2026-53702

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...

org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers

A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-57511 SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SM...

CVE-2026-46428

A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...

CVE-2026-48536 GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48536

GFI Archiver

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...