CVE-2026-33586

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...

CVE-2026-33586 Authenticated SMTP Sender Address Forgery

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...

CVE-2026-33586 Authenticated SMTP Sender Address Forgery

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...

CVE-2026-33586

Authenticated users of OVH mail servers can perform SMTP sender address forgery by manipulating both the "Envelope-from" and "From" fields. This vulnerability stems from the default SPF configuration, which includes include:mx.ovh.com. Consequently, any user with a valid OVH email account can sen...

GSA Bounty: Email Spoofing - SPF record set to Neutral

Hi, Introduction: There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more...

Mixmax: Security Vulnerability - SMTP protection not used

Hi, I'm checking your website found SPF record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...

Gratipay: No Valid SPF Records.

SPF record lookup and validation for: gratipay.com SPF records are published in DNS as TXT records. The TXT records found for your domain are: ALIAS for nara-9076.herokussl.com Checking to see if there is a valid SPF record. No valid SPF record found of either type TXT or type SPF. Check...

Google Moving Gmail to Strict DMARC Implementation

By next summer, most of the major Web-based email providers will have implemented a policy of strictly adopting the DMARC protocol. Google, in a statement published Tuesday by DMARC.org, said it will move gmail.com to a policy of rejecting any messages that don’t pass the authentication checks...