CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation triggered when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to cause an index out of bounds panic , aborting the client p...

CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

EUVD-2026-67687

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235

filebrowser through 2.63.23 fails to validate named pipes in its directory archive and public download handlers. This causes blocking open syscalls that pin server goroutines and exhaust connection resources, resulting in a denial of service . Both authenticated users and anonymous visitors with ...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2023-23752-EXPLOIT

CVE-2023-23752 - Joomla Controllo di accesso improprio È stato identificato un problema nelle versioni di Joomla dalla 4.0.0 alla 4.2.7. Questa vulnerabilità è legata a un controllo di accesso improprio all'interno dell'applicazione, che consente l'accesso non autorizzato a endpoint critici del...

EUVD-2026-67681

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

CVE-2026-73209 affects the IMAP process in Open-Xchange Dovecot , where an attacker with valid credentials can send crafted compressed data that causes the process to exhaust its stack and crash. The resulting process termination can lead to degradation or denial of service for IMAP services. The...

CVE-2026-52687

CVE-2026-52687 affects Open-Xchange Dovecot . An attacker with valid credentials can select a compression algorithm on the IMAP connection whose decompression state requires large memory , and by opening several such connections, reach the process memory limit with only a few connections. This te...

EUVD-2026-67679

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

CVE-2026-52681

CVE-2026-52681 affects Dovecot's Sieve component. CPU resource usage is tracked in the compiled script, so an attacker with valid credentials can reset the accounting by repeatedly changing the active script. Additionally, compiled script files are not removed when a script is deleted or renamed....