EUVD-2026-68804

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

PT-2026-84038

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...

MAL-2026-15590 Malicious code in com.db.autobahn.notification-center-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452 package.json declares preinstall and postinstall lifecycle scripts that automatically run curl on npm install to send installer identity whoami,...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Dete...

CVE-2026-81679

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-80207

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-81679

OpenRemote versions before 1.28.0 are affected by a cross-realm information disclosure vulnerability in the Notification REST API . An attacker with read:admin credentials in a single realm can issue a zero-parameter GET request to the notification endpoint and retrieve sent notification metadata...

EUVD-2026-67035

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81679 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81679 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

EUVD-2026-67141

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-80207 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-80207 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...

CVE-2026-80207

APITable through 1.13.0-beta.1 is affected by a missing authentication flaw on the Internal Notify Controller create handler. The endpoint is annotated with requiredLogin = false, and the ResourceInterceptor returns before any session or API-key validation. Because the shipped nginx gateway proxi...

CVE-2026-81279

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81279

The WordPress plugin Push Notification for Post and BuddyPress versions

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

EUVD-2026-66986

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.20...