CVE WatchOct 26, 2026

CVE-2026-8142

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address fo

CVSS

6.5

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: May 7, 2026 · Last modified: Oct 26, 2026

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-10-052026-11-01

Technical description

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

Official references

github.comhttps://github.com/CERTCC/VINCE
kb.cert.orghttps://kb.cert.org/vince

Related CVEs

No related CVEs by CWE or product.