CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-61855

The open source helpdesk system Zammad versions 7.0.3 and 7.1.1 is vulnerable to an issue where inbound PGP-signed emails may be incorrectly marked with a valid ("Good" ) signature status. This occurs under certain conditions because the verification process can identify a valid signature from a ...

CVE-2026-61855 Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

EUVD-2026-87265

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465 Zammad: S/MIME signature verification allows forged sender impersonation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84465

The open source helpdesk system Zammad is vulnerable to sender impersonation in versions prior to 7.1.2 . The root cause is that the system fails to verify if an S/MIME-signed email's certificate is genuinely trusted; instead, it only checks if a certificate with a matching name exists in the sys...

CVE-2026-97063

The X-SpringBoot framework, versions through 6.0 , is vulnerable to an authentication bypass due to the exposure of login verification codes. The application returns these codes directly in HTTP responses from unauthenticated endpoints, specifically GET /sys/mobile/code and GET /sys/email/code , ...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727

The open-source helpdesk system Zammad is vulnerable to PGP signature spoofing prior to version 7.0.2 . The root cause is that the system silently discards the return value of the gpg verification call during inbound PGP email processing. Consequently, the handler unconditionally writes a success...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

LinkedIn adds new checks for fake profiles and work histories

LinkedIn is adding trust and verification features aimed at making fake professional identities, invented work histories, and company impersonation harder to pull off. The company is responding to an environment in which generative AI enables imposters to create an entirely made-up professional...

BIT-NEXTCLOUD-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

Salmon Introduces Execution Verification Infrastructure (EVI) for Securing AI Agents and Autonomous Systems

San Francisco, USA, 25th September 2026, CyberNewswire...

CVE-2026-73253

A flaw was found in Mongoose. Wildcard certificate matching in its built-in Transport Layer Security TLS stack does not properly restrict matches to a single domain level. An on-path network attacker with a valid wildcard certificate for a parent domain could exploit this flaw to bypass hostname...

CVE-2026-86837

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

CVE-2026-86837 Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

CVE-2026-86837

The Bookly WordPress plugin versions prior to 28.3 contains a vulnerability where it fails to properly verify a customer's identity during personal information updates. An unauthenticated attacker who possesses a customer's primary identifier can exploit this verification bypass to overwrite sens...