47025 matches found
AZL-98280 CVE-2026-33604 affecting package dovecot 2.3.20-1
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
ALPINE-CVE-2026-33604
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
CVE-2026-33604
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
EUVD-2026-67659
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
CVE-2026-33604
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
CVE-2026-80630
In the Linux kernel, the following vulnerability has been resolved: net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever fqcodel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...
PT-2026-83300
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...
The vulnerability in the lib/LWP/UserAgent.pm module, a set of modules for working with LWP::UserAgent web resources, allows a perpetrator to access confidential data.
The vulnerability of the lib/LWP/UserAgent.pm component, a module for working with LWP::UserAgent web resources, is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...
The vulnerability of the OpenSSH cryptographic protection mechanism, which stems from the use of an unprotected alternative channel, allows attackers to compromise data integrity.
The vulnerability of the OpenSSH cryptographic protection lies in the use of an unprotected alternative channel. Exploiting this vulnerability could allow a attacker to compromise the integrity of data...
The vulnerability of the OpenSSH cryptographic protection mechanism, related to the implementation of an incorrect control flow, allows a attacker to compromise the integrity of data.
The vulnerability of the OpenSSH cryptographic protection lies in the implementation of an incorrect control flow. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data remotely...
UBUNTU-CVE-2026-33604
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
PT-2026-83052
This update for dovecot23 fixes the following issues: - CVE-2024-23184: parsing of messages containing many address headers From, To, Cc, Bcc, etc. could be excessively CPU intensive bsc1229184. - CVE-2024-23185: large headers can cause resource exhaustion when parsing message bsc1229183. -...
The vulnerability of the OpenSSH cryptographic protection mechanism, which arises from performing operations in the wrong order, allows attackers to gain access to confidential data and compromise the integrity of that data.
The vulnerability of the OpenSSH cryptographic protection lies in the improper execution of certain operations. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise the integrity of those data...
CVE-2026-59307
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses dompurify-3.4.8.tgz which is vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor component uses dompurify-3.4.8.tgz which is vulnerable to CVE-2026-65898, CVE-2026-65899. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in DOMPurify
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is...
EUVD-2026-67192
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
SUSE CVE-2026-74334
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...
EUVD-2026-67023
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...
