TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2026-8142

Medium · published May 7, 2026

CVSS v3.1

6.5

EPSS

Percentile

4.1

In the wild

Unconfirmed

What it is

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00153 · 4.1th percentile
Published: 2026-05-07T19:54Z

EPSS history

Timeline

07 MAY 19:54Z
CVE-2026-8142
cvelistv5