AZL-98286 CVE-2026-40017 affecting package dovecot 2.3.20-1

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

DEBIAN-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

AZL-98316 CVE-2026-33607 affecting package dovecot 2.3.20-1

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

AZL-98259 CVE-2026-33605 affecting package dovecot 2.3.20-1

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

DEBIAN-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

ALPINE-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

ALPINE-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

Security update for python36

This update for python36 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969...

SUSE-SU-2026:3855-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969. -...

Key Reasons Why Identity Fabric Matters in 2026

An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on...

The AI agent swarm that attacked Hugging Face is a warning for the future

The hacking incident involving OpenAI evaluation agents and Hugging Face offers an unusually concrete look at what advanced AI-assisted intrusion can mean in practice: not a single clever exploit, but thousands of automated decisions, rapid experimentation, lateral movement, credential theft,...

Vulnerabilities in Wibu-Systems’ CodeMeter Runtime

Wibu-Systems has addressed several vulnerabilities in CodeMeter Runtime. These vulnerabilities are located in various components of CodeMeter Runtime, particularly in versions 8.41a and 9.10. A local attacker can exploit incorrect verification of NTFS reparse points when creating temporary files...

Exploit for CVE-2026-46339

CTT-Enhanced-CVE-2026-46339-Exploit-Engine A specialized Pytho...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ZBT, each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTE...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Dete...

CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...