341 matches found
cpanel2shell-scanner
cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...
CVE-2026-126133
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This...
CVE-2026-126133
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...
CVE-2026-126614
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the...
CVE-2026-126626
Progressive Robot hMailServer versions 6.3.3 through 6.3.7 are vulnerable to an overly restrictive account lockout mechanism (CWE-645). The web services listener incorrectly identifies the address of a trusted proxy (local or defined in WebServicesTrustedProxies ) as the source of failed CardDAV,...
EUVD-2026-123338
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own...
CVE-2026-126626 Overly Restrictive Account Lockout Mechanism in hMailServer
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own...
EUVD-2026-123334
The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...
CVE-2026-126618 Improper Restriction of Excessive Authentication Attempts in hMailServer
The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...
CVE-2026-126618
The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...
Linux Distros Unpatched Vulnerability : CVE-2026-126133
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's...
CVE-2026-126618: Improper Restriction of Excessive Authentication Attempts
The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...
CVE-2026-126614: Improper Restriction of Excessive Authentication Attempts
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the...
CVE-2026-126133
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...
DEBIAN-CVE-2026-126133
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...
CVE-2026-126133
The Thunderbird email client is vulnerable to a flaw where it may transmit calendar server credentials (username and password) to an HTTP proxy requesting authentication. This occurs during the setup of new calendars or the syncing of existing CalDAV or ICS calendars. The vulnerability allows a m...
EUVD-2026-122687
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...
CVE-2026-126133 Calendar server credentials could be sent to an HTTP proxy
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...
Security Vulnerabilities fixed in Thunderbird 153.7 — Mozilla
When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment a .desktop file on Linux, or a .url or .lnk file on Windows was replaced with the content of the file or URL it pointed to when the message was saved or sent...
PT-2026-144425
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent...