EUVD-2026-118488

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the recipients method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the...

CVE-2026-63437

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the recipients method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the...

CVE-2026-121424

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...

CVE-2026-121424

The Nodemailer library (versions 3.0.0 before 10.1.4) contains an address parsing vulnerability in the addressparser component. The root cause is that the parser incorrectly handles nested RFC 5322 comments by ending them at the first closing parenthesis. This allows remote attackers to craft add...

CVE-2026-121424 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...

CVE-2026-121424 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...

EUVD-2026-115956

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...

CVE-2026-120328

The TYPO3 extension "Mail" (mail) is affected by an Information Disclosure vulnerability (CVE-2026-120328 ) in its click tracking middleware. The root cause is a failure to validate a recipient's authentication code when that code is omitted. This allow unauthenticated attackers to retrieve perso...

Linux Distros Unpatched Vulnerability : CVE-2026-121424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending...

CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

EUVD-2026-114110

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

CVE-2026-119283

A flaw was found in joserfc. When decrypting a JSON Web Encryption JWE object, the library fails to limit the number of recipient entries processed in a single request. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JWE token with an arbitrarily large recipients...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

PT-2026-132841

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.5 Description The decrypt json function in the joserfc.jwe module processes a JWE General JSON Serialization recipients array without a count limit, calling decrypt cek for every entry. An unauthenticated attacker...

CVE-2026-105997: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code…

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients...

CVE-2026-82983

The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...

EUVD-2026-111133

The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...

CVE-2026-82983

The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...

CVE-2026-82983

The Tables app contains a vulnerability in the share-listing endpoint (GET /apps/tables/share/table/{tableId}). The application fails to verify if a requesting user possesses manage-level permission before returning a full list of share recipients, including users, groups, and teams, along with t...