CVE-2026-61815

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

EUVD-2026-86335

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815

The zbateson/mail-mime-parser library is vulnerable to CRLF header injection (CWE-93) in versions prior to 3.0.6 and 4.0.2 . The root cause is the interpolation of attacker-influenced attachment filenames into Content-Type and Content-Disposition headers without stripping CR/LF characters. This a...

CVE-2026-61815 zbateson/mail-mime-parser has CRLF header injection via attachment filename

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

thunderbird: Thunderbird: Memory safety violations via maliciously crafted mail headers

A flaw was found in Thunderbird where a maliciously constructed mail header could lead to ambiguous parsing. This vulnerability could result in multiple mail header fields being incorrectly interpreted as one, or cause memory safety violations. A remote attacker could potentially exploit this to...

thunderbird: One byte overflow read in mail parser

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior...

PT-2026-98191

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The partial-pipeline resume mechanism accepts the partial token as a bearer credential without binding it to the browser session that created it. This allows an attacker to initiate an...

PT-2026-98219

Name of the Vulnerable Software and Affected Versions zbateson/mail-mime-parser versions prior to 3.0.6 zbateson/mail-mime-parser versions prior to 4.0.2 Description CRLF carriage-return / line-feed header injection occurs when the library is used to build or forward MIME messages with an...

PT-2026-98220

Name of the Vulnerable Software and Affected Versions zbateson/mail-mime-parser versions 2.0.0 through 3.0.5 zbateson/mail-mime-parser versions 4.0.0 through 4.0.1 Description An uncontrolled resource consumption and algorithmic complexity issue affects applications parsing untrusted emails. Thre...

CVE-2026-61816: Uncontrolled Resource Consumption

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerabili...

CVE-2026-61815: Improper Neutralization of CRLF Sequences

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-90905

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

Security Bulletin: Multiple Vulnerabilities were found in IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import...

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

EUVD-2026-85048

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

PT-2026-97517

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description The 'administrator/index.php?option=com easystore&task=appconfig.updateConfiguration' endpoint allows the update of core Joomla mail configuration in the configuration.php file without...