AWS
CVE-2026-22239
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.
AnalysisAI
BLUVOYIX's email sending API contains design flaws that permit unauthenticated attackers to send arbitrary emails on behalf of affected organizations through specially crafted HTTP requests. This integrity issue requires no user interaction and could enable large-scale spam or phishing campaigns originating from compromised systems. No patch is currently available for this vulnerability.
Technical ContextAI
Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Bluvoyix. The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Craft CMS versions 3.5.0-4.16.17 and 5.0.0-RC1-5.8.21 contain a server-side request forgery vulnerability in the save_im
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side
Hono is a Web application framework that provides support for any JavaScript runtime. [CVSS 8.2 HIGH]
Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.
The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege esca
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows una
Timing side-channel attacks in AWS-LC's AES-CCM decryption implementation allow unauthenticated attackers to infer authe
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allShare
External POC / Exploit Code
Leaving vuln.today