CVE-2026-40590 FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. Under limited visibility, the endpoint drops unique-email validation. If the supplied email already...

Mail.ru: No bruteforce protection leads to enumeration of emails in http://e.mail.ru/

There is no bruteforce protection here http://e.mail.ru/cgi-bin/passrestore?email=email here Also the actual thing is when I put a non-existing email in the above url's "email" parameter I get an error. But if i put my email there it gives the option to recover my password which means the email...