CVE-2026-110870

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870

A flaw was found in Nodemailer. A remote attacker can bypass domain allow-lists or cause email delivery failures by submitting specially crafted recipient addresses. Because the address parser fails to properly strip parenthesized comments within formatted email addresses, unvalidated characters...

PT-2026-114184

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

Linux Distros Unpatched Vulnerability : CVE-2026-110870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside...

Internationalized Domain Name Validation

Nodemailer is vulnerable to an internationalized domain name validation/bypass. The vulnerability is due to inconsistent Punycode A-label generation, which allows an attacker to craft recipient addresses containing invisible characters or compatibility mappings to bypass domain allow-list checks...

SUSE CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598: Interpretation Conflict

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

GHSA-WMMP-3585-3RMP Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

PT-2026-94115

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.0 Description Nodemailer fails to apply UTS-46 normalization when encoding international domain names IDN, leading to a discrepancy between how the software and standards-compliant parsers such as web browsers...

GO-2026-6058 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

CVE-2026-6517 Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...

CVE-2026-6517 Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

Mattermost Desktop App versions =6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that...

CVE-2026-6517

Mattermost Desktop App (versions

Linux Distros Unpatched Vulnerability : CVE-2022-1981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab,...

BIT-GITLAB-2022-1981

An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintaine...

FreeBSD : Gitlab -- multiple vulnerabilities (d1b35142-ff4a-11ec-8be3-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d1b35142-ff4a-11ec-8be3-001b217b3468 advisory. - A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions...