Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 18, 2026IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frCVE-2025-36045 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
- Product
- TS4300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Mailgun for: Does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing listsCVE-2026-14834 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.
- Product
- Mailgun for
- Fixed in
- 2.2.1
- What to do
- Update Mailgun for to 2.2.1 or newer.
May 19, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.CVE-2026-35086 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Mar 16, 2026IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interactioCVE-2025-13212 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026twinklesmtp – Email Service Provider For: Stored Cross-Site ScriptingCVE-2025-14887 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- twinklesmtp – Email Service Provider For
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update twinklesmtp – Email Service Provider For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interCVE-2025-13211 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, befoCVE-2025-13765 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Action Mailer is a framework for designing email service layers.CVE-2024-47889 · Other software · rails · reported by GitHubMedium 6.6
Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the verCVE-2024-30848 · Other software · silversky · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the version parameter.
- Product
- email_service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024Tuta is an encrypted email service.CVE-2024-23655 · Other software · tutao · reported by GitHubHigh 7.5
Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.
- Product
- tutanota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Tuta is an encrypted email service.CVE-2024-23330 · Other software · tutao · reported by GitHubMedium 5.3
Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.
- Product
- tutanota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023In email service, there is a missing permission check.CVE-2023-30915 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023In email service, there is a missing permission check.CVE-2023-30914 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /CVE-2019-25075 · Other software · Gravitee · reported by MITREMedium 6.1
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
- Product
- API Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2021ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service.CVE-2021-32816 · Other software · ProtonMail · reported by GitHubMedium 6.5
ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular expression denial-of-service vulnerability. This was fixed in commit 6687fb. There is a full report available in the referenced GHSL-2021-027.
- Product
- WebClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.