CVE-2025-36045: Improper Control of Interaction Frequency

IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency...

CVE-2026-85271: Improper Neutralization of Input During Web Page Generation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-40539: Improper Certificate Validation

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2025-13882: Improper Control of Interaction Frequency

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to imprope...

Linux Distros Unpatched Vulnerability : CVE-2026-92597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break...

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-54907 Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54907

Caddy Proxy Manager , a web interface for managing Caddy Server reverse proxies and certificates, enabled email and password self-registration by default (at /api/auth/sign-up/email) prior to version 1.5.1 . This allowed an unauthenticated remote actor to create an active account with the user ro...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

EUVD-2026-82386

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker providing two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0 , the handleInbound handler delivers inbound alias mail via message.forward(), which silently drops the Reply-To header intended to route responses through the relay. W...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

GHSA-6J36-R6PR-59X4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

EUVD-2026-81668

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-63472

Vendure , an open-source headless commerce platform, is vulnerable to account takeover via its external authentication system. In ExternalAuthenticationService.createCustomerAndUser, an existing customer is matched by email address alone and a new external authentication method is attached withou...