CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server through 0.16.19 fails to validate OAuth redirect_uri against registered destinations in its default configuration. The root cause lies in crates/http/src/auth/oauth/registration.rs, where the validation routine returns success immediately because the client-authentication req...

PT-2026-82224

Name of the Vulnerable Software and Affected Versions Stalwart Mail Server affected versions not specified Description In its default configuration, the server fails to validate OAuth redirect targets against registered destinations. The validation routine in...

CVE-2026-66140 vulnerabilities

Vulnerabilities for packages: exim...

UBUNTU-CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

UBUNTU-CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

CVE-2026-67194 Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

CVE-2026-67194 Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

CVE-2026-67194

CVE-2026-67194 affects Courier IMAP prior to 6.0.1 and Courier Mail Server prior to 2.0.2. The vulnerability lies in the SEARCH parser (alloc_search_key in searchinfo.C), which recursively descends through deeply nested parenthesized groups without a depth limit. A single IMAP command with ~2500 ...

CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

Linux Distros Unpatched Vulnerability : CVE-2026-67194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH...

CVE-2026-48536

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

The vulnerability of the Dovecot mail server, related to insufficient input validation, allows attackers to cause service failures.

The vulnerability of the Dovecot mail server is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of Dovecot and OX Dovecot Pro mail servers, related to improper control of resource identifiers (“resource injection”), allows attackers to cause service failures.

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Dovecot mail server, related to the possibility of bypassing the authentication process, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server relates to the possibility of bypassing the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Dovecot mail server, related to insufficient protection of service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-47083

A flaw was found in Cyrus IMAP. An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other...