[SECURITY] Fedora 43 Update: radicale-3.9.0-1.fc43

The Radicale Project is a CalDAV calendar and CardDAV contact server. It aims to be a light solution, easy to use, easy to install, easy to configure. As a consequence, it requires few software dependencies and is pre-configured to work out-of-the-box. The Radicale Project runs on most of the...

[SECURITY] Fedora 45 Update: radicale-3.9.0-1.fc45

The Radicale Project is a CalDAV calendar and CardDAV contact server. It aims to be a light solution, easy to use, easy to install, easy to configure. As a consequence, it requires few software dependencies and is pre-configured to work out-of-the-box. The Radicale Project runs on most of the...

[SECURITY] Fedora 43 Update: radicale-3.8.3-1.fc43

The Radicale Project is a CalDAV calendar and CardDAV contact server. It aims to be a light solution, easy to use, easy to install, easy to configure. As a consequence, it requires few software dependencies and is pre-configured to work out-of-the-box. The Radicale Project runs on most of the...

[SECURITY] Fedora 44 Update: radicale-3.8.3-1.fc44

The Radicale Project is a CalDAV calendar and CardDAV contact server. It aims to be a light solution, easy to use, easy to install, easy to configure. As a consequence, it requires few software dependencies and is pre-configured to work out-of-the-box. The Radicale Project runs on most of the...

AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790974923)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790974923 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user wi...

CLSA-2026-1790974923 cyrus-imapd: Fix of 2 CVEs

fix CVE-2026-61911: Sieve mailboxexists/metadata tests ignored the lookup ACL on another user's mailbox - fix CVE-2026-61909: CalDAV/CardDAV multiget did not check the ACL of each requested href...

Rocky Linux 9.6 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790173408)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790173408 advisory. - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user...

openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21929-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21929-1 advisory. Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 -...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

CVE-2026-68490

A flaw in the CalDAV and CardDAV services of cPanel & WHM allows a local user to read sensitive calendar events and contacts belonging to other accounts due to incorrect permission assignments. This issue affects cPanel & WHM version 120 and later . Remediation is available in versions 11.134.0.5...

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

EUVD-2026-85620

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change...

[SECURITY] Fedora 45 Update: cyrus-imapd-3.12.4-1.fc45

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

CVE-2026-68490: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

PT-2026-97569

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

OPENSUSE-SU-2026:21929-1 Security update for cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: Update to 3.8.8 bugfix release: - CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL bsc1279908 - CVE-2026-61908: JMAP email-header blob ID out-of-bounds index bsc1279975 - CVE-2026-61909: CalDAV/CardDAV...

PT-2026-97063

Name of the Vulnerable Software and Affected Versions cPanel/WHM versions 120 through 11.133.x cPanel/WHM versions 11.134.0 through 11.134.0.56 cPanel/WHM versions 11.136.0 through 11.136.0.40 cPanel/WHM versions 11.138.0 through 11.138.0.7 WP2 versions prior to 11.138.1.11 Description Remote...

SUSE CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...