CVE-2026-119761

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

EUVD-2026-114238

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

CVE-2026-119761

The Axigen Mail Server WebMail (versions before 10.6.39 and 10.7.1 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the improper neutralization of unescaped sender display names within the conversation view. An unauthenticated remote attacker can send an ema...

CVE-2026-119761 Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

PT-2026-133710

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

CVE-2026-119761: Axigen Axigen Mail Server: Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows…

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display...

CVE-2026-116167

SiYuan versions 2.9.0 before 3.8.7 are vulnerable to a cross-site scripting (XSS) flaw on the unauthenticated /check-auth page. The root cause is a lack of scheme validation when the application assigns the to parameter to window.location.href. An attacker can provide a crafted link using a javas...

CVE-2026-116167 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking...

ViewSonic vCast authorization issue vulnerability

ViewSonic vCast v3.2.715 and earlier versions contain an authorization issue vulnerability. This vulnerability arises because the screen capture endpoint lacks authentication. Unauthenticated remote attackers can use GET requests to access the /snapshot or /screen endpoints, thereby obtaining JPE...

Mettle sendportal-core Authorization Issue Vulnerability

Mettle sendportal-core 4.0.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass, allowing authenticated workspace members to attach subscribers to tags in other workspaces by providing unvalidated tag IDs. Attackers can submit...

CVE-2026-104891

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...

CVE-2026-91788

Foxit PDF Editor/Reader is vulnerable to an information disclosure flaw because the JavaScript interface fails to perform the required attribute authorization checks . This oversight allows a trusted malicious PDF to potentially access sensitive content from other documents residing within the sa...

CVE-2026-40326: Cross-Site Request Forgery (CSRF)

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in csettings.cfc does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or link that, when visited by a logged-in...

CVE-2026-33764

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled $REQUEST'id' parameter without validating that the AI response belongs to the specified video. An authenticated user wi...

Hacktivists claim near-total Spotify music scrape

Hacktivist group Anna’s Archive claims to have scraped almost all of Spotify’s catalog and is now seeding it via BitTorrent, effectively turning a streaming platform into a roughly 300 TB pirate “preservation archive.” On its blog, the group states: “A while ago, we discovered a way to scrape...

Perplexity Is a Bullshit Machine

A WIRED investigation shows that the AI-powered search startup Forbes has accused of stealing its content is surreptitiously scraping—and making things up out of thin air...

How to Prevent ChatGPT From Stealing Your Content & Traffic

ChatGPT and similar large language models LLMs have added further complexity to the ever-growing online threat landscape. Cybercriminals no longer need advanced coding skills to execute fraud and other damaging attacks against online businesses and customers, thanks to bots-as-a-service,...

Why You Shouldn't Tie IP Addresses to Tokens

Locking tokens to the client IP address might seem like a good way to prevent content theft, such as sharing of authenticated URLs that include tokens. It might even appear to work in small-scale test environments. However, the internet has evolved to a point where it’s quite common for clients t...

Five Ways Bad Bots Are Threatening Financial Services

For years now, the biggest security concerns for businesses in the financial services sector have mainly been related to data security, privacy, compliance and everything in between. Nevertheless, application security is equally as important and complex, as it consists of multiple potential attac...

Information Disclosure

thunderbird is vulnerable to information disclosure. A same-origin policy bypass flaw was found in Thunderbird. Remote HTML content could steal private data from different remote HTML content Thunderbird has loaded...