AZL-98262 CVE-2026-42391 affecting package dovecot 2.3.20-1

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

EUVD-2026-67674

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

Open-Xchange Dovecot is vulnerable to a denial-of-service attack in its imap-login process. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before authentication, causing disproportionate memory and CPU consumption . The resulting out-of-memory termi...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

UBUNTU-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

PT-2026-83067

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can send an IMAP ID command containing an excessive number of parameters before authentication. This action causes disproportionate growth in memory and CPU usage,...

PT-2026-83231

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.3.0 through 2.3.0-246-9852aff4 Description A user with Write but not Admin permissions on a shared child project can detach that project from its parent hierarchy. This is possible by submitting a parent project id value of ...

PT-2026-83257

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.6.0 through 2.8.0 Description The OIDC authorization page in the frontend redirects the browser to an attacker-controlled URL without consulting the backend redirect URI allow-list when the request uses prompt=none. An...

CVE-2026-81706

creationtimestamp| type| source ---|---|--- 2026-08-27 18:09:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3gza2b7k2t 2026-08-27 19:24:01+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117169103851890443 2026-08-28 10:20:06+00:00| seen|...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54713 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-54713

CakePHP Queue (a queue-interop compatible queueing library) has an incomplete comparison in QueueManager::getUniqueId() that affects versions 0.1.11 through 2.3.1 . When shouldBeUnique is enabled, the method generates job identifiers from the job class, method, and parameters, but sorting paramet...

CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments

Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

EUVD-2026-66996

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...