CVE-2026-121729

HIGH8.3

Published 2026-11-03 · Source disclosure@vulncheck.com

Description

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

CWE-862

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-121731
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
2026-11-03 · score 8.8
CVE-2026-121727
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
2026-11-03 · score 7.5
CVE-2026-121565
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
2026-11-03 · score 7.4
CVE-2026-120775
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
2026-11-03 · score 7.2
CVE-2026-116651
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
2026-11-03 · score 7.5