CVE-2026-44742

MediumCVSS 6.1/10Last modified Nov 11, 2026

Description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Postorius project	Postorius	<= 1.3.13

References

https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868bPatch
https://gitlab.com/mailman/postorius/-/issues/620Issue Tracking, Vendor Advisory
https://gitlab.com/mailman/postorius/-/merge_requests/972Issue Tracking, Patch
https://www.openwall.com/lists/oss-security/2026/05/07/3Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/05/msg00045.html

Timeline

Published: May 7, 2026
Last modified: Nov 11, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-447433.7Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive infor CVE-2026-447446.5SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an aut CVE-2026-447458.1SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an CVE-2026-447466.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could cra CVE-2026-447479.9SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory cor CVE-2026-447489.9SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mes CVE-2026-447494.3The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex CVE-2026-44758.8A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the fi CVE-2026-447504.3SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. This could allow a lo CVE-2026-447517.1Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report g CVE-2026-447528.2SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim CVE-2026-447533.7SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable r