51611 matches found
CVE-2026-50191
In 4gaBoards versions prior to 3.3.8, an attacker creates an unverified local account using a victim's email via POST /api/register, then authenticates it via POST /api/access-tokens even with isVerified=false. When the victim first logs in via Google, GitHub, Microsoft, or OIDC SSO, the SSO help...
CVE-2026-62448
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite component: Message Component. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center...
EUVD-2026-61495
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite component: Message Component. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center...
EUVD-2026-61438
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Email Marketing. Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to...
CVE-2026-44472
Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...
CVE-2026-45125
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...
CVE-2026-45125 MyBB: Email User CRLF injection
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...
CVE-2026-45125 MyBB: Email User CRLF injection
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...
EUVD-2026-61011
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...
crypto/x509: Incorrect enforcement of email constraints in crypto/x509
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...
ANT-2026-7WJV60DR · supabase/auth · other
other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7WJV60DR: Manual identity linking enables account takeover via unverified email When...
ANT-2026-125WT6QC · supabase/supabase · denial-of-service
denial-of-service low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-125WT6QC: Catastrophic backtracking in t-shirt competition email regex The get-tshirt-competition examp...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
EUVD-2026-60820
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-23922
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...
CVE-2026-23922
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...
CVE-2026-74988
Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR...
CVE-2026-74988
Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154,...
CVE-2026-74990
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was...