Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.16.69 security update

Red Hat build of MicroShift release 4.16.69 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RLSA-2026:22120 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

PT-2026-82222

Name of the Vulnerable Software and Affected Versions Netmaker affected versions not specified Description Netmaker disables certificate verification when connecting to the configured mail server. In the file pro/email/smtp.go, the sender assigns a TLS configuration where the skip-verify field is...

CVE-2026-81036: URL Redirection to Untrusted Site

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

RHCOS 4 : OpenShift Container Platform 4.19.44 (RHSA-2026:57401)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57401 advisory. - net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 Note that Nessus has not tested for this issue bu...

PT-2026-82224

Name of the Vulnerable Software and Affected Versions Stalwart Mail Server affected versions not specified Description In its default configuration, the server fails to validate OAuth redirect targets against registered destinations. The validation routine in...

PT-2026-82251

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects...

RHCOS 4 : Red Hat build of MicroShift 4.18.54 (RHSA-2026:57914)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57914 advisory. - net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 - net/mail: golang: net/mail: Denial of...

RHCOS 4 : Red Hat build of MicroShift 4.16.69 (RHSA-2026:57845)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57845 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

RockyLinux 9 : golang (RLSA-2026:22121)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22121 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

CVE-2026-55619 eml_parser: Parser DoS via deeply nested parentheses in e-mail headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.parser.HeaderParser.headerfetchparse in emlparser/parser.py uses email.utils.getaddresses to parse address-bearing e-mail...

EUVD-2026-65703

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.parser.HeaderParser.headerfetchparse in emlparser/parser.py uses email.utils.getaddresses to parse address-bearing e-mail...

Acelle-Mail-4.2.0-p97-Unauthenticated-SSTI-to-RCE-Chain

Acelle Mail 4.2.0-p97 — Unauthenticated SSTI to RCE Chain V...

CVE-2026-75575: Improper Restriction of Excessive Authentication Attempts

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview org.apache.camel:camel-mail is a Camel Mail support. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the unmarshal process when headersInline is enabled. An attacker can manipulate...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

CakePHP , a PHP rapid development framework, is affected by a CRLF header injection vulnerability in its mail transport layer. Custom mail headers added via Message::setHeaders() or Message::addHeaders() do not strip CRLF bytes, allowing an attacker to inject arbitrary headers when user-controlle...