UBUNTU-CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +136 more potentially affected by CVE-2026-82661 via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =3.35.0, =1.0.0-beta.1, =4.0.0-canary.13686, =7.0.0-canary.3009 and more Source cves: CVE-2026-82661 Source advisory:...

@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +136 more potentially affected by CVE-2026-82660 via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =3.35.0, =1.0.0-beta.1, =4.0.0-canary.13686, =7.0.0-canary.3009 and more Source cves: CVE-2026-82660 Source advisory:...

@dargmuesli/nuxt-vio (>=20.6.0, <=21.0.0-beta.11), @darraghor/nest-backend-libs (>=5.0.10, <=5.0.11) +52 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.3)

nodemailer NPM version =8.0.0, =20.6.0, =5.0.10, =0.0.1-beta.0, =0.2.0-alpha.1, =6.0.0-beta.9, =11.14.0, =5.8.38, =2.9.4-beta.9766, =0.1.10, =1.11.4, =2.1.8, =0.0.0-experimental.09a2220201377abea1f719e6f8d201b10ae3f7af, =2.0.0, =3.2.11, =20260208.152.42, =20260327.0.55 and more Source cves: unkno...

@activepieces/piece-imap (>=0.2.17, <=0.3.2), @akiflow/mailauth (>=0.0.1, <=0.0.2) +71 more potentially affected by CVE-2025-13033 via nodemailer (>=7.0.2, <=7.0.6)

nodemailer NPM version =7.0.2, =0.2.17, =0.0.1, =1.0.0, =3.3.1, =0.0.1, =0.6.0, =5.1.663-alpha, =1.2.4, =29.1.0, =1.0.1, =2.12.3-snapshot-1749038455154, =4.0.0, =1.0.25, =8.0.1, =7.0.7, =8.1.17 and more Source cves: CVE-2025-13033 Source advisory: OSV:GHSA-MM7P-FCC7-PG87...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +398 more potentially affected by CVE-2021-23400 via nodemailer (>=6.0.0, <=6.6.0)

nodemailer NPM version =6.0.0, =1.0.49, =0.0.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.7, =1.16.0, =1.16.0, =1.16.0, =1.16.1, =2.4.4 and more Source cves: CVE-2021-23400 Source advisory: SNYK:JS-NODEMAILER-1296415...

[SECURITY] [DLA 1591-1] libphp-phpmailer security update

Package : libphp-phpmailer Version : 5.2.9+dfsg-2+deb8u4 CVE IDs : CVE-2017-5223 CVE-2018-19296 It was discovered that there were two vulnerabilities libphp-phpmailer, an email library for the PHP programming language: CVE-2017-5223: Local file disclosure vulnerability via relative path HTML...

Debian: Security Advisory (DLA-1591-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-2695

TIT-AL00C583B211 has a directory traversal vulnerability which allows an attacker to obtain the files in email application...

FreeBSD : codeigniter -- multiple vulnerabilities (71ebbc50-01c1-11e7-ae1b-002590263bf5)

The CodeIgniter changelog reports : Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when 'mail' or 'sendmail' are used thanks to...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used thanks to Pa...