CVE-2026-123620: webmin usermin: Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated…

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in...

CVE-2026-120332

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report...

CVE-2026-120331

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network...

CVE-2026-120330

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including t...

CVE-2026-120330

The TYPO3 extension "Mail" is affected by a broken access control vulnerability (CWE-862) in its backend actions and AJAX routes. The module fails to verify if a backend user has permission to access the specific mail or recipient group being requested. Consequently, authorized users can view, ch...

EUVD-2026-115739

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including t...

CVE-2026-120331

The TYPO3 Extension "Mail" (mail) is vulnerable to Server-Side Request Forgery (SSRF) . The application fails to validate the target host when fetching content, stylesheets, and images from external URL mails to embed. Consequently, backend users with access to the mail module can force the serve...

EUVD-2026-115738

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network...

EUVD-2026-115737

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report...

CVE-2026-120332

The TYPO3 Extension "Mail" (mail) is vulnerable to Cross-Site Scripting (XSS) due to the backend module rendering the HTML content of emails and tracked URLs without proper escaping. An attacker with backend access to the mail module can inject arbitrary HTML and JavaScript , which executes withi...

PT-2026-136069

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including t...

CVE-2026-120330: TYPO3 Extension "Mail": Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the…

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including t...

CVE-2026-112287 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

CVE-2026-112287

Krayin CRM versions prior to 2.2.7 are vulnerable to a broken object level authorization vulnerability within the EmailController write actions. This flaw allows authenticated users with restricted scopes to manipulate emails belonging to other users by providing specific numeric IDs. Specificall...

CVE-2026-112287 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

CVE-2026-112287 Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nginx: nginx-1.30.3-2.hum1 aarch64, x8664 nginx-all-modules-1.30.3-2.hum1 noarch nginx-core-1.30.3-2.hum1 aarch64, x8664 nginx-filesystem-1.30.3-2.hum1 noarch nginx-mod-devel-1.30.3-2.hum1 aarch6...

SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2050-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2050-1 advisory. This update for nginx fixes the following issues - CVE-2026-27651: denial of service via undisclosed requests when the...

nginx security update

2:1.26.3-2.0.1.el101.2 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-8 - Fix release number 2:1.26.3-7 - Resolves: RHEL-176217 - nginx: NGINX: Arbitrary Code 2:1.26.3-6 - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially...