https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 23:48:36 +0000 https://db.gcve.eu/vuln/cve-2026-112356 <p><strong>Affected:</strong> GFI USA, LLC GFI KerioConnect</p> <p>GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim&#39;s authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter&#39;s re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim&#39;s session.</p> <p><strong>Affected:</strong> GFI USA, LLC GFI KerioConnect</p> <p>GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim&#39;s authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter&#39;s re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim&#39;s session.</p> https://db.gcve.eu/vuln/cve-2026-112356