Memcached 安全漏洞

Memcached is a high-performance distributed memory object caching system developed by the Memcached community in the United States. Versions of Memcached prior to 1.6.42 contained a security vulnerability. This vulnerability stemmed from the sequential side channel in the password data used durin...

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

CVE-2026-41319: Improper Neutralization of Special Elements in Output Used by a Downstream Component

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication...

CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information wi...

AZL-81692 CVE-2025-59032 affecting package dovecot 2.3.20-1

ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unavailable for other users. Control access to ManageSieve port, or disable the service if it's not needed. Alternatively upgrade to a fixed...

AZL-81686 CVE-2025-59028 affecting package dovecot 2.3.20-1

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

dovecot:fuzz-sasl-authentication: Heap-buffer-overflow in p_strdup

Project: https://github.com/dovecot/core.git Detailed Report: https://oss-fuzz.com/testcase?key=6005584358080512 Project: dovecot Fuzzing Engine: afl Fuzz Target: fuzz-sasl-authentication Job Type: aflasandovecot Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x7aa570ae84...

OESA-2025-2394 ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation. Security Fixes: SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple...

EUVD-2017-6593

Malware in sbrugna...

EUVD-2018-8635

Malware in sbrugna...

EUVD-2014-0193

Malware in sbrugna...

EUVD-2021-1565

Malware in sbrugna...

EUVD-2019-5020

Malware in sbrugna...

EUVD-2023-2679

Malicious code in bioql PyPI...

EUVD-2024-0609

Malicious code in bioql PyPI...

EUVD-2022-7637

Malicious code in bioql PyPI...

EUVD-2022-5820

Malicious code in bioql PyPI...

UBUNTU-CVE-2025-40918

Authen::SASL::Perl::DIGESTMD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, i...

PostgreSQL JDBC library -- Improper Authentication

PostgreSQL JDBC Driver project reports: Client Allows Fallback to Insecure Authentication Despite channelBinding=require configuration. Fix channel binding required handling to reject non-SASL authentication Previously, when channel binding was set to "require", the driver would silently ignore...

Apache Kafka 安全漏洞

Apache Kafka is an open source distributed streaming platform from the Apache USA Foundation. The platform is capable of fetching real-time data for building applications that react in real-time to changes in data streams. A security vulnerability exists in Apache Kafka that stems from a...