CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: p11-kit (UTSA-2026-032284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032284 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the...

PT-2026-83067

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can send an IMAP ID command containing an excessive number of parameters before authentication. This action causes disproportionate growth in memory and CPU usage,...

The vulnerability of the udhcp_getoption() function in the networking/udhcp/common.c component of the BusyBox command-line utility tools allows a attacker to gain access to confidential data.

The vulnerability of the udhcpgetoption function in the networking/udhcp/common.c component of the BusyBox command-line utility tools on UNIX systems is related to reading data from a buffer beyond its allowable limits. Exploiting this vulnerability could allow an attacker to gain access to...

PT-2026-82959

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd mutex is unlocked vub300 cmndwork thread holds cmd mutex while it sends a command and waits for the command response. If the response wait times out, vub300 command response kills the command UR...

The vulnerability of the Util-linux command-line utility suite relates to the use of memory after it is freed, allowing an attacker to trigger a service failure.

The vulnerability of the Util-linux command-line utility suite relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the Shell command shell in Windows operating systems, which allows attackers to exploit their privileges

The vulnerability of the Shell command shell in Windows operating systems is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the setSystemConfig() function in the CGI Handler component of the Totolink-N600R router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the setSystemConfig function in the CGI Handler component of the Totolink-N600R router’s microprogramming system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

UBUNTU-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

UBUNTU-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

UBUNTU-CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon...

CVE-2022-46169

CVE-2022-46169 Questo repository contiene una Proof of Concept PoC per la CVE-2022-46169 - RCE non autenticata su Cacti = 1.2.22 concatenando un bypass dell'autenticazione e un'iniezione di comandi, descritta da Sonar in questo post del blog. Le stesse vulnerabilità sono state scoperte anche da:...

aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...

GHSA-VXJ7-4XRP-5VR4 aiosmtplib: STARTTLS response injection

Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately performs the TLS handshake without discarding any data still sitting in the receive buffer. Bytes the protocol read off the plaintext socket before the handshake survive across the...