https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-04T23:05:38.233961+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120450 fkie_cve-2026-120450 2026-11-04T23:05:38.235411+00:00

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

 https://db.gcve.eu/vuln/ghsa-g452-mgph-pcc8 GHSA-g452-mgph-pcc8 2026-11-04T23:05:38.235589+00:00

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.