CVE-2026-107272

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

EUVD-2026-94403

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107272

Gophish versions through 0.12.1 are vulnerable to stored and reflected cross-site scripting (XSS) due to unescaped SMTP server error messages . An attacker who controls or intercepts a sending profile's SMTP server can inject malicious scripts. These scripts execute when administrators view campa...

CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107272: Improper Neutralization of Input During Web Page Generation

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

PT-2026-107576

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-104714

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

EUVD-2026-92625

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714

A race condition vulnerability in Apache Struts allows for improper synchronization when localized messages format date or time arguments. The application-wide text provider retains a formatter for these messages, which is then used by concurrent requests without isolation. This can result in a v...

CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

PT-2026-106136

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description A race condition occurs when a localized message formats...

PT-2026-104445

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint,...

Uncaught Exception

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Uncaught Exception via createRequest and createRequestFromNodeRequest in node.ts when processing a request with a malformed port valu...

PT-2026-102764

Name of the Vulnerable Software and Affected Versions NetX RTSP Server affected versions not specified Description An unauthenticated client can cause a denial of service by draining the RTSP server's packet pool. This occurs when requests are sent containing a Session header that the parser cann...

Astra Linux – Vulnerability in PostgresSQL 11

The use of server error messages by clients in PostgreSQL allows a server that is not trusted under current SSL or GSS settings to send arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message claiming that a human user or someone...

BIT-KIBANA-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...