0xdps vulnerabilities

Products

• 0xdps/emailflare 2

Latest 0xdps CVEs

Newest publication first

1. CVE-2026-121729 emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

   Published 2026-11-03

   High·CVSS 7.2 EPSS 0.25%

   emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any doma...

2. CVE-2026-121730 emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

   Published 2026-11-03

   High·CVSS 7.1 EPSS 0.22%

   emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.