Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

CVE-2026-45447

🚨 CVE-2026-45447 - Critical OpenSSL Use-After-Free Vulnerability Heap Use-After-Free in PKCS7verify allowing memory corruption, crashes, and potential remote code execution. 📖 Executive Summary CVE-2026-45447 is a critical vulnerability in OpenSSL's PKCS7 verification functionality. The flaw exis...

Linux Distros Unpatched Vulnerability : CVE-2026-113869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load...

CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

A flaw was found in Thunderbird. When requesting a security device password, such as a smartcard PIN or Primary Password, while decrypting a Secure/Multipurpose Internet Mail Extensions S/MIME message, the message loading process can finish or be canceled while the prompt remains open. This...

CVE-2026-113869 Use-after-free in S/MIME decryption during a security device password prompt

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

Mozilla Thunderbird versions earlier than 158.0.1 are vulnerable to a use-after-free memory error during S/MIME message decryption. The flaw occurs when a message load finishes or is canceled while an interactive password prompt (e.g., for a smartcard PIN or Primary Password) is still open, causi...

EUVD-2026-105296

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113869

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

KLA91360 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security vulnerability can be exploited to bypass securit...

CVE-2026-93635

The Zimbra Collaboration Suite (versions 10.1.0 through 10.1.21) is vulnerable to an LDAP filter injection caused by unescaped computeDn() template substitutions. This flaw allows unauthenticated attackers to manipulate external LDAP search filters. In environments utilizing search-filter authent...

EUVD-2026-101457

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...

CVE-2026-107587

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...

EUVD-2026-94865

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...

CVE-2026-107587 Improper Certificate Validation in hMailServer

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...

CVE-2026-107587

Progressive Robot hMailServer versions 6.3.2 through 6.3.5 are vulnerable to improper certificate validation within the webmail component. A remote unauthenticated attacker can cause the system to retain a signer's certificate—regardless of whether the certificate chain is trusted—under the first...

CVE-2026-107587 Improper Certificate Validation in hMailServer

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...

CVE-2026-103647

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...

CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...

CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...