CVE-2026-55986

The Gitea Git repository management platform is vulnerable to an access control deficiency in its Email Management API . This flaw allows an attacker to bypass restrictions within the ManageCredentials feature, potentially leading to privilege escalation remotely. While specific affected versions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

EUVD-2026-58140

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

EUVD-2026-58070

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-28182

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

EUVD-2026-57726

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin (versions before 3.2.6 ) is vulnerable to an unauthenticated account takeover due to a type-juggling authentication bypass. The root cause is a loose comparison used to validate the email-verification activation code, which can be s...

EUVD-2026-57632

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

CVE-2026-73531: Improper Neutralization of Input During Web Page Generation

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

Oracle Linux 8 : grafana (ELSA-2026-54243)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54243 advisory. - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 - Resolves RHEL-219393: CVE-2026-42127 Tenable has extracted th...

CVE-2026-73420: Incorrect Behavior Order: Validate Before Canonicalize

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

PT-2026-71832

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. The addGoogleStrategy function in apps/webapp/app/services/googleAuth.server.ts passes a Google profile...