122932 matches found
CVE-2026-47086
CYRUS IMAPD has a vulnerability CVE-2026-47086 affecting Cyrus IMAP up to version 3.12.2. The GENURLAUTH feature allows issuance of URLAUTH tokens by any authenticated user for named mailboxes, bypassing ACLs and enabling reading mail from those mailboxes without granted permissions. The issue is...
CVE-2026-47085
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...
CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...
PT-2026-60555
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...
PT-2026-60554
Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.3 Description An issue exists where tokens issued via the GENURLAUTH command can bypass Access Control Lists ACLs. An authenticated user can generate a URLAUTH token for any specified mailbox, regardless of...
CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...
python3.9 security, bug fix, and enhancement update
3.9.25-7.0.1.el98.2 - Remove upstream URL reference 3.9.25-7.2 - Security fix for CVE-2026-15308 Resolves: RHEL-193786 3.9.25-7.1 - Fix ssl.SSLError: ASN1: NOTENOUGHDATA not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207...
CVE-2026-47085
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...
CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...
ROS-20260716-73-0027
The vulnerability of the Omnibox address bar in Google Chrome browsers on iOS operating systems is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to replace the content in the URL bar using a specially created domain name...
openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21319-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21319-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo: discrepancy betwe...
GHSA-PR64-JMMF-JP54 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
Security Advisory: SSRF in remote MCP server authentication discovery Severity: High. CWE: CWE-918. Affected: ToolHive through the latest release v0.29.3 and current main HEAD b672d82f, 2026-06-12; re-verified 2026-06-14. FetchResourceMetadata and the discovery clients remain unguarded; no commit...
GHSA-GGW3-5987-RX77 Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback
Summary The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow Pomerium Zero / hosted authenticate, the proxy's /.pomerium/callback endpoint is reachable without credentials...
CVE-2026-52893
creationtimestamp| type| source ---|---|--- 2026-07-15 23:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqptj4dkuq2w 2026-07-16 00:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpxqavaqm2i...
CVE-2026-53446
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl private-network checks from...
CVE-2026-52891
creationtimestamp| type| source ---|---|--- 2026-07-15 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5spsbr25 2026-07-16 00:30:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyal2izp2s 2026-07-18 04:18:04+00:00| seen|...
CVE-2026-40956
creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:32+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptvxfo62x...
CVE-2026-62312
creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpptu2t522m 2026-07-16 00:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpx4mn2pk2l...