CVE-2026-82191

J2Store (Joomla extension by j2commerce.com) versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7 are affected by a parameter injection flaw in the PayPal notify redirect handler. Unescaped request data is reflected into the redirect sent to com_j2store's checkout controller, allowing an attacker ...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927

IBM Security Verify Identity Access (and IBM Security Verify Access ) reverse proxy may allow parameter injection into requests forwarded to third-party services (CWE-74). An unauthenticated network attacker with high attack complexity could cause limited confidentiality loss and high integrity i...

CVE-2026-58200

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

CVE-2026-58200

@jhb.software/payload-cloudinary-plugin (Payload CMS Cloudinary storage adapter), versions 0.3.0 through 0.4.0 , is affected by an Improper Verification of Cryptographic Signature (CWE-347) when clientUploads: true is enabled. The POST /api/cloudinary-generate-signature endpoint in cloudinary/src...

DEBIAN-CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

UBUNTU-CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

EUVD-2026-76774

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, enabling ESMTP parameter injection into MAIL FROM and RCPT TO envelope commands. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters such as AUTH , NOTIFY , or ORC...

CVE-2026-90467

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

Linux Distros Unpatched Vulnerability : CVE-2026-90467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO...

PT-2026-90555

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-77654

Improper Privilege Management vulnerability in Horizon Security Analyzer formerly AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that ...

CVE-2026-77654

Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit contains an Improper Privilege Management flaw affecting versions A33.10, A33.20, and A33.30 . The root cause is a misconfigured entry in the sudoers file : a local user with command-line access can escalate privileges...