CVE-2026-39971

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.

• CWE-113

• https://github.com/s9y/Serendipity/releases/tag/2.6.0Patch
• https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6rExploit, Mitigation, Vendor Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39966TypeBot is a chatbot builder tool. In versions 3.15.2, the g…6.5
• CVE-2026-39967TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…3.1
• CVE-2026-39968TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…7.1
• CVE-2026-39969TypeBot is a chatbot builder tool. In versions 3.16.0 and pr…6.5
• CVE-2026-3997The Text Toggle plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-39970TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…8.5
• CVE-2026-39972Mercure is a protocol for pushing data updates to web browse…7.1
• CVE-2026-39973Apktool is a tool for reverse engineering Android APK files.…7.1
• CVE-2026-39974n8n-MCP is a Model Context Protocol (MCP) server that provid…8.5
• CVE-2026-39976Laravel Passport provides OAuth2 server support to Laravel. …7.1
• CVE-2026-39977flatpak-builder is a tool to build flatpaks from source. Fro…6.3
• CVE-2026-39979jq is a command-line JSON processor. In commits before 2f090…6.5