270 matches found
CVE-2026-82983
The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...
CVE-2026-82983
The Tables app contains a vulnerability in the share-listing endpoint (GET /apps/tables/share/table/{tableId}). The application fails to verify if a requesting user possesses manage-level permission before returning a full list of share recipients, including users, groups, and teams, along with t...
CVE-2026-82983
The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...
EUVD-2026-111133
The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...
PT-2026-126672
The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...
GHSA-M943-M63M-W62W Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...
CVE-2026-63578
The bc-csharp library (versions before 2.7.0 ) by Legion of the Bouncy Castle Inc. is vulnerable to a denial of service via CPU exhaustion in the PbeUtilities.GenerateCipherParameters function. This is caused by the allocation of resources without limits during password-based private-key decrypti...
WordPress WP Verify API plugin <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients vulnerability
Unauthenticated Verification Code Email Sending to Arbitrary Recipients vulnerability discovered by RIA Labs in WordPress Plugin WP Verify API versions = 1.0.0...
EUVD-2026-84269
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...
CVE-2026-19862
JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...
CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-79632
The WPFunnels WordPress plugin (versions before 3.13.0 ) contains a vulnerability where one of its opt-in submission handlers fails to perform authorisation or nonce checks . This flaw allows unauthenticated users to manipulate the request to provide arbitrary notification recipients and subjects...
CVE-2026-86090: Missing Authorization
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
PT-2026-91802
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-18044
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on...
CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...
CVE-2026-48088
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...
EUVD-2026-54174
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...