cpanel2shell-scanner

cpanel2shell-scanner 一个用于跟踪的cPanel/WHM认证绕过漏洞 CVE-2026-41940 的高保真扫描器。它能识别易受攻击的主机，而不会产生公共PoC和检测中常见的假阴性，也不会触发干扰简单扫描的账户锁定和根IP白名单机制。 该工具还附带了一个独立的、可选利用链，用于同一家族的cpdavd上的CalDAV路径遍历漏洞（端口2079明文/2080 TLS）—— CVE-2026-29205 —— 一旦一个小的SMTP驱动设置步骤成功，远程攻击者就可以以root身份 读取任意文件。cPanel 11.134.0.26...

CVE-2026-61915

A flaw was found in cyrus-imapd. An authenticated calendar user could trigger a double-free vulnerability in the Cyrus CalDAV worker. By sending a specially crafted PATCH request that includes PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind, the memor...

CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

Linux Distros Unpatched Vulnerability : CVE-2026-61909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to anoth...

Linux Distros Unpatched Vulnerability : CVE-2026-61915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker wit...

DEBIAN-CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

UBUNTU-CVE-2026-61915

VPATCH BYPARAM double-free: An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the...

UBUNTU-CVE-2026-61909

CalDAV/CardDAV multiget bypasses per-href ACL: An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT...

CVE-2026-61915

VPATCH BYPARAM double-free: An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the...

EUVD-2026-75132

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2026-61915

Cyrus IMAP before 3.12.4 contains a VPATCH BYPARAM double-free vulnerability. An authenticated calendar user can crash a Cyrus CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource that has two or more properties of the matched kind. The root cause is that th...

CVE-2026-61909

Cyrus IMAP versions before 3.12.4 are affected by a per-href ACL bypass in the CalDAV/CardDAV multiget functionality. An authenticated DAV user with some shared access to another user's calendar or address book can read unshared events or contacts by including the target hrefs in a calendar-multi...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

EUVD-2026-75168

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

PT-2026-89142

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...