CVE-2026-66149

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-66149

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-66149

CVE-2026-66149 affects SonicWall Email Security appliances. An authenticated user with access to the restricted CLI can exploit a code-injection weakness to run arbitrary OS commands as root via netmask, via a local attack vector. The combined CVSS 3.1 metrics indicate high impact to confidential...

EUVD-2026-56946

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-62882 Microsoft Outlook Spoofing Vulnerability

...

CVE-2026-62882 Microsoft Outlook Spoofing Vulnerability

...

CVE-2026-62882

The CVE-2026-62882 entry concerns Microsoft Office Outlook, with a vulnerability described as insufficiently protected credentials that allows an unauthenticated attacker to perform spoofing over a network. According to the CVSSv3.1 metrics, the impact is low confidentiality, no integrity or avai...

CVE-2026-70329 Microsoft Outlook Remote Code Execution Vulnerability

...

CVE-2026-70329

CVE-2026-70329 describes an integer overflow or wraparound in Microsoft Office Outlook that allows an unauthenticated attacker to achieve remote code execution over a network . The associated metrics indicate a CVSS v3.1 base score of 8.8 (HIGH) with attack vector: NETWORK , attack complexity: LO...

CVE-2026-62914 Microsoft Exchange Server Spoofing Vulnerability

...

CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability

...

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18639

CVE-2026-18639 affects Velociraptor's OIDC authenticator. The vulnerability arises when Velociraptor uses the email claim as a username; some IdPs allow changing the email without verification, and some do not set or verify the email_verified claim. This can enable a user to impersonate another b...

CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

SonicWall Email Security Affected By Multiple Vulnerabilities

1 CVE-2026-66149 - Improper Control of Generation of Code 'Code Injection' Vulnerability via netmaskImproper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restrict...

CVE-2026-72772

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...