cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

CentOS Linux 8.5 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS8.5:CLSA-2026:1790252040)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790252040 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a...

CentOS Linux 8 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS-STREAM8:CLSA-2026:1790769478)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1790769478 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash ...

CentOS Linux 8.4 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (CENTOS8.4:CLSA-2026:1790758129)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790758129 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a...

openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21929-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21929-1 advisory. Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 -...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

CVE-2026-68490

A flaw in the CalDAV and CardDAV services of cPanel & WHM allows a local user to read sensitive calendar events and contacts belonging to other accounts due to incorrect permission assignments. This issue affects cPanel & WHM version 120 and later . Remediation is available in versions 11.134.0.5...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

EUVD-2026-85620

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change...

[SECURITY] Fedora 45 Update: cyrus-imapd-3.12.4-1.fc45

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

CVE-2026-68490: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

PT-2026-97569

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

OPENSUSE-SU-2026:21929-1 Security update for cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 - CVE-2026-61908: JMAP email-header blob ID out-of-bounds index bsc1279975 - CVE-2026-61909: CalDAV/CardDAV...

PT-2026-97063

Name of the Vulnerable Software and Affected Versions cPanel/WHM versions 120 through 11.133.x cPanel/WHM versions 11.134.0 through 11.134.0.56 cPanel/WHM versions 11.136.0 through 11.136.0.40 cPanel/WHM versions 11.138.0 through 11.138.0.7 WP2 versions prior to 11.138.1.11 Description Remote...

CVE-2026-91973

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

EUVD-2026-78649

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...