CVE Watch26 oct 2026

CVE-2026-8142

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address fo

CVSS

6.5

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 7 may 2026 · Última mod.: 26 oct 2026

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-10-042026-11-01

Descripción técnica

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

Referencias oficiales

github.comhttps://github.com/CERTCC/VINCE
kb.cert.orghttps://kb.cert.org/vince

CVEs relacionados

Sin CVEs relacionados por CWE o producto.