CVE-2026-84114 Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication

A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been...

CVE-2026-84114

Cleo Harmony versions up to 5.8.1.10 contain an improper authentication vulnerability in the SAML Authentication component, specifically in the function LocalUserUtil.getNativeUserByAssertions . Manipulation of the Email argument allows a remote attacker with low privileges to bypass authenticati...

CVE-2026-82853

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol SMTP commands due to improper sanitization of carriage return and line feed characters in the transport name option. This can lead to email spoofing and phishing attacks...

CVE-2026-82661

A flaw was found in Nodemailer, an email sending library. This vulnerability allows a remote attacker with control over specific list comment parameters to inject arbitrary message headers into generated email messages. By failing to sanitize carriage return and line feed CRLF characters, an...

CVE-2024-58379

A flaw was found in Nodemailer. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability by sending specially crafted emails containing malicious data URLs or embedded attachments. This can cause the email parsing process to hang, leading to a denial of service for...

CVE-2026-33604

A flaw was found in Dovecot. A remote attacker can exploit this by crafting a message with a specific line ending. If Dovecot relays this message, it can bypass security protections, allowing the attacker to inject spoofed email into a vulnerable downstream mail server. This vulnerability is...

CVE-2026-40014

A flaw was found in Dovecot. A remote attacker, by sending a specially crafted email message header to a user, can cause the Internet Message Access Protocol IMAP THREAD command to consume excessive CPU resources. When a mail client processes this message, it can lead to degradation or a denial o...

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75964

CVE-2026-75964 affects the User Profile Builder WordPress plugin in all versions up to and including 4.0.0 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'email' parameter of the email-confirmation feature, caused by insufficient input sanitization and output escaping. An unaut...

CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

EUVD-2026-68985

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

PT-2026-84116

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-73524: Improper Neutralization of Input During Web Page Generation

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

PT-2026-84525

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.15 Thunderbird versions prior to 153.2 Thunderbird versions prior to 155 Description Triggering an error condition in certain MIME bodies Multipurpose Internet Mail Extensions, a standard that allows email to...

CVE-2026-75964: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

Linux Distros Unpatched Vulnerability : CVE-2024-58379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedd...

PT-2026-84466

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

PT-2026-84285

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.1.11 Description An issue exists in the SAML Authentication component where manipulation of the Email argument within the LocalUserUtil.getNativeUserByAssertions function allows for improper authentication...

sublime-rules — Updated!

Sublime Rules by Sublime Security This repo contains open-source rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Examples HTML smuggling VIP / Executive impersonation Malicious OneNote files Malicious LNK files...