Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-121730

emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
0xdps
Products
Emailflare
CVE-2026-121729

emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
0xdps
Products
Emailflare