CVE-2026-22239CWE-400

Email Sending Vulnerability in BLUVOYIX

Critical · published January 14, 2026

CVSS v4.0
10.0
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploitation of this vulnerability could allow the attacker to send unsolicited emails to anyone on behalf of the company.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:H/U:Amber
EPSS
0.00318 · 23.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-01-14T14:40Z
EPSS history
Timeline
  • 14 JAN 14:40Z
    Email Sending Vulnerability in BLUVOYIX
    cvelistv5