Oracle Linux 8 : grafana (ELSA-2026-11507)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-11507 advisory. - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 - Resolves RHEL-166519: CVE-2026-32282 - Resolves RHEL-167380:...

📄 GoAnywhere MFT 7.9.1 HTML Injection

GoAnywhere MFT versions prior to 7.10.0 are affected by an HTML injection vulnerability in the email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these message...

EUVD-2026-26382

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function...

PT-2026-36084

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-smtp affected versions not specified Description The SmtpHook component in the SMTP provider calls the Python function smtplib.SMTP.starttls without an SSL context. This omission prevents certificate validation during...

CVE-2026-36340

An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function...

Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send

Summary Several administrative operations in Admidio's preferences module database backup, test email, htaccess generation fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger...

GHSA-RW74-VC9H-534J Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send

Summary Several administrative operations in Admidio's preferences module database backup, test email, htaccess generation fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger...

Exploit for CRLF Injection in Useplunk Plunk

CVE-2026-34975 — CRLF Email Header Injection in Plunk via raw...

Improper Certificate Validation

Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...

CVE-2026-40229

Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML...

CVE-2026-40229 Helpy 2.8.0 - Stored XSS in post author display via PostsHelper

Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML in their account name field and cause it to be rendered unescaped in public forum threads where they participate, in the admin ticket view, and in HTML...

io.jenkins.plugins:zohosprints (>=1.0, <=1.1.4), org.jenkins-ci.plugins:build-name-setter (2.0.4) +6 more potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1.54)

org.jenkins-ci.plugins:script-security MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:zohosprints =1.0, =2.4, =2.62.1, =2.2, =1.78, =2.0.0, =1.14,...

org.jenkins-ci.plugins.workflow:workflow-cps (>=3990.vd281dd77a_388, <=3993.v3e20a_37282f8), org.jenkins-ci.plugins:badge (>=2.4, <=2.5) +2 more potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1367.vdf2fc45f229c)

org.jenkins-ci.plugins:script-security MAVEN version 1367.vdf2fc45f229c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =3990.vd281dd77a388, =2.4...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-5, <=0.1-beta-7), org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-5, <=0.1-beta-7) +4 more potentially affected by CVE-2026-42519 via org.jenkins-ci.plugins:script-security (1.6)

org.jenkins-ci.plugins:script-security MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-5, =0.1-beta-5,...

connection reuse ignores TLS requirement

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...

grafana security update

9.2.10-30.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-30 - Resolves RHEL-166519: CVE-2026-32282 - Resolves RHEL-167380: CVE-2026-32280 - Resolves RHEL-167542: CVE-2026-32283...

PT-2026-37147

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9 Description Several administrative operations within the preferences module are executed via GET requests without CSRF token validation. This allows an attacker to force an authenticated administrator to trigger...

WordPress Check & Log Email plugin < 2.0.13 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Matthew Rollings in WordPress Plugin Check & Log Email versions 2.0.13...

CLSA-2026-1777366733 python3: Fix of CVE-2026-1299

CVE-2026-1299: reject newline injection in email module's BytesGenerator when serializing headers - Skip test.testxmletree.XMLPullParserTest.testsimplexml during RPM build; unrelated expat-2.1.0-15.0.7.tuxcare.els1 regression breaks XMLPullParser chunked-feed semantics in TuxCare ELS el7 build...

WordPress Highlight and Share CVE-2025-67586

Detects vulnerable Highlight and Share plugin versions = 5.2.0 exposed to unauthenticated email share abuse via admin-ajax. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress cla...