CVE-2026-48539

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

CVE-2026-48536 GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

EUVD-2026-48295

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48534

CVE-2026-48534 affects GFI Archiver prior to 15.13. It is a stored XSS in the IMAP Server configuration via the server URL parameter to /Archiver/ImapServerWizard.aspx. The payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and can execute in browsers of users w...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

[SECURITY] Fedora 44 Update: nginx-1.30.4-1.fc44

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

The vulnerability of the Dovecot mail server, related to insufficient input validation, allows attackers to cause service failures.

The vulnerability of the Dovecot mail server is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of Dovecot and OX Dovecot Pro mail servers, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Local Mail Transfer Protocol (LMTP) used by Dovecot and OX Dovecot Pro mail servers, which is related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Local Mail Transfer Protocol LMTP used by Dovecot and OX Dovecot Pro mail servers involves an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures...

The vulnerability of Dovecot and OX Dovecot Pro mail servers, related to improper control of resource identifiers (“resource injection”), allows attackers to cause service failures.

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of Dovecot and OX Dovecot Pro mail servers, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Dovecot mail server, related to the possibility of bypassing the authentication process, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server relates to the possibility of bypassing the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Dovecot mail server, related to insufficient protection of service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

EUVD-2026-47550

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

EUVD-2026-47099

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successfu...

CVE-2026-61247

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

Apple has moved to address a security flaw in its Hide My Email service that enabled users' real email addresses to be unmasked, effectively undermining the feature's privacy guarantees. 404 Media reported Tuesday that a fix for the issue was deployed by Apple on July 3, 2026, after more than a...

CVE-2026-28313 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments...

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol SNMP monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection...