CVE-2026-119417

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119417

The CakePHP framework versions 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 are vulnerable to an email header injection flaw. The root cause lies in SmtpTransport and MailTransport components, which only strip CRLF pairs, leaving a window for attacker...

CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-119417 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

EUVD-2026-113797

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

PT-2026-133470

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom...

CVE-2026-34975

CVE-2026-34975 — CRLF Email Header Injection in Plunk via raw MIME construction Severity : High CVSS 8.5 CWE : CWE-93 — Improper Neutralization of CRLF Sequences 'CRLF Injection' Affected : useplunk/plunk = 0.7.1 Fixed in : 0.8.0 Advisory : GHSA-2mvm-rg5v-7hfq NVD :...

EUVD-2026-112675

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

CVE-2026-115303

The Contact Form by Supsystic WordPress plugin (versions before 1.11.1 ) is vulnerable to unauthenticated CRLF / Email Header Injection . The root cause is the failure to strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers. This occur...

CVE-2026-115303 Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Unauthenticated CRLF / Email Header Injection vulnerability

Unauthenticated CRLF / Email Header Injection vulnerability discovered by Emirhan Sevmez in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

[SECURITY] [DSA 6579-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 23, 2026 https://www.debian.org/security/faq -...

Debian dsa-6579 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from an email header injection issue during Bounce operations. The function rcubemime::decodeaddresslist fails to remove control characte...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail only strips line breaks from the Subject and Organization headers, failing to sanitize other header values receiv...

CVE-2026-91831

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

EUVD-2026-104101

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...

WordPress Subscribe to Comments plugin < 2.3.3 - Author+ Email Header Injection vulnerability

Author+ Email Header Injection vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...

CVE-2026-91831 Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the send...