2240 matches found
CVE-2026-94214
ST Engineering iDirect Evolution and Velocity WebServer Evolution (versions up to 20260717 ) contain an open redirect vulnerability in the Management Service component, specifically in the /login.html file. The root cause is unsanitized manipulation of the Host argument, allowing a remote attacke...
PT-2026-96089
Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717 Description An open redirect issue exists in the Management Service component within the /login.html file. A remote attacker ca...
CVE-2026-94214: URL Redirection to Untrusted Site
A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to...
PT-2026-96092
Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717 Description A remote open redirect issue exists within the HTTP Header Handler component. The flaw is located in the authorize...
CVE-2026-94216: URL Redirection to Untrusted Site
A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...
[SECURITY] Fedora 44 Update: evolution-3.60.2-2.fc44
Evolution is the GNOME mailer, calendar, contact manager and communications tool. The components which make up Evolution are tightly integrated with one another and act as a seamless personal information-management tool...
[SECURITY] Fedora 43 Update: evolution-3.58.3-2.fc43
Evolution is the GNOME mailer, calendar, contact manager and communications tool. The components which make up Evolution are tightly integrated with one another and act as a seamless personal information-management tool...
Fedora 43 : evolution (2026-1ea9bbcb29)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1ea9bbcb29 advisory. Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859. Tenable has extracted the preceding description block directly from the...
Fedora 44 : evolution (2026-99a4ff5552)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-99a4ff5552 advisory. Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859. Tenable has extracted the preceding description block directly from the...
CVE-2026-91997
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
CVE-2026-91997
evolution-api through version 2.3.7 contains a Prometheus metrics IP allowlist bypass . The root cause is an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, effectively disabling the IP whitelist. This allows unauthenticated remote attackers to acce...
EUVD-2026-78437
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
CVE-2026-91997: Incorrect Comparison
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
PT-2026-91937
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...
Astra Linux – Vulnerability in evolution-data-server
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client by dereferencing a NULL pointer, by sending an invalid e.g., minimal CAPABILITY line during a connection attempt. This issue is related to the imapxfreecapability and imapxconnecttoserver functions...
Astra Linux – Vulnerability in Wireshark
In Wireshark versions 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This issue was addressed in the epan/dissectors/packet-lte-rrc.c file by adjusting certain append operations...
