EUVD-2026-46121

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-47255 AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-47255 AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-47255 AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

CVE-2026-47129

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

EUVD-2026-44689

Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim...

CVE-2026-47133

ClearanceKit on macOS stores per-record policy data in /Library/Application Support/clearancekit/store.db with ECDSA signatures in data_signatures. Prior to 5.0.10, the signed payload lacks a monotonic counter or freshness binding, allowing an attacker who can modify store.db and the matching dat...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

CVE-2026-44584

Paymenter documents describe a vulnerability where the email update flow does not reset or revalidate the existing email verification status. In versions prior to 1.5.0, a user can change their email while remaining marked as verified, potentially misrepresenting email ownership and bypassing ver...

CVE-2026-44584 Paymenter doesn't reset email verification status after email change

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

dotnet: .NET Security Feature Bypass Vulnerability

A flaw was found in .NET. An unauthorized attacker can exploit this vulnerability over a network due to improper verification of cryptographic signatures. This allows the attacker to bypass a critical security feature, potentially leading to significant compromise of confidentiality, integrity, a...

CVE-2026-46715

Summary of CVE-2026-46715 (Flask-Security-Too) Affected: Flask-Security-Too up to version 5.8.0. Issue: in the OAuth reauthentication flow, the verification callback can mark a victim’s session as freshly reauthenticated after an OAuth identity belonging to a different user is verified. If an att...

CVE-2026-44978 xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-46428

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

CVE-2026-46428

CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...