CVE-2026-104083

SmarterMail versions before build 9777 are vulnerable to a stored mutation cross-site scripting (XSS) vulnerability. The root cause lies in a custom HTML sanitizer that incorrectly treats a element nested within MathML foreign content (specifically ) as inert CDATA text, while browsers reparse i...

EUVD-2026-95888

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...