https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:29:55.339319+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-366356 EUVD-2026-366356 2026-10-03T22:29:55.342936+00:00 EUVD-2026-366356 https://cve.radiocsirt.org/vuln/fkie_cve-2026-88859 fkie_cve-2026-88859 2026-10-03T22:29:55.342995+00:00

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

 https://cve.radiocsirt.org/vuln/ghsa-8j98-q77q-pmv2 GHSA-8j98-q77q-pmv2 2026-10-03T22:29:55.343094+00:00

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-88859 UBUNTU-CVE-2026-88859 2026-10-03T22:29:55.343141+00:00

Affected: Ubuntu:16.04:LTS: evolution, Ubuntu:18.04:LTS: evolution, Ubuntu:20.04:LTS: evolution, Ubuntu:22.04:LTS: evolution, Ubuntu:24.04:LTS: evolution, Ubuntu:26.04:LTS: evolution

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.