Linux Distros Unpatched Vulnerability : CVE-2026-33606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protoco...

CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

ALPINE-CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

AZL-98304 CVE-2026-33606 affecting package dovecot 2.3.20-1

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

EUVD-2026-67661

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-33606

Open-Xchange Dovecot is affected by a vulnerability in the dsync protocol's stream mode. Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration or replication...

CVE-2026-75142

A flaw was found in FFmpeg. A stack buffer overflow exists in the MPEG-PS muxer. A local attacker or a user processing a specially crafted file with an excessive number of streams could trigger this flaw, leading to a buffer overflow. This could potentially result in denial of service or arbitrar...

CVE-2026-64833

A flaw was found in FFmpeg, specifically within the S/PDIF muxer. A remote attacker can exploit an out-of-bounds read vulnerability by providing a specially crafted DTS-HD audio stream during S/PDIF re-muxing. This allows the attacker to read memory beyond the intended buffer boundaries,...

CVE-2026-80716

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

CVE-2026-80716

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

CVE-2026-80716 ALSA: pcm: wake linked drain waiters on unlink

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

CVE-2026-80716

CVE-2026-80716 affects the ALSA PCM subsystem in the Linux kernel . When snd_pcm_drain() is called on a linked stream, it parks an on-stack wait entry on the drained peer's sleep queue. If group membership changes during the wait and the sleep ends via signal or timeout, finish_wait() is skipped,...

UBUNTU-CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

PT-2026-83054

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description Mail content stored by a user can be crafted to be interpreted as dsync protocol commands when an administrator executes dsync using the stream protocol, such as during migration or replication...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

DEBIAN-CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...