Zimbra - Cross-Site Scripting via ICS Files

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

PT-2026-115261

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue decode ical string in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2026-104083 SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

EUVD-2026-95888

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

PT-2026-108954

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a element nested within MathML foreign conten...

PT-2026-97003

Name of the Vulnerable Software and Affected Versions icalendar versions 6.1.0 through 7.2.1 Description The vInt.from ical function accepts an attacker-controlled VALARM REPEAT value. Applications requesting alarm times may eagerly expand this value without an application-level limit. This...

CVE-2026-63643

A flaw was found in MagicMirror². This flaw involves a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to cause the server to make requests to arbitrary domains. Specifically, the ADDCALENDAR handler in the defaultmodules/calendar/nodehelper.js component, accessible via t...

CVE-2026-63643

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

GHSA-W6X9-28JW-HQ7J MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...

CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

PT-2026-77238

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The ADD CALENDAR handler in defaultmodules/calendar/node helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO...

CVE-2026-11896

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to...

CVE-2026-8495

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

EUVD-2026-30992

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

CVE-2026-8495 Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

CVE-2026-8495

The Drupal Date iCal module (versions 0.0.0 through 4.0.14 ) is vulnerable to a Missing Authorization flaw allowing Forceful Browsing . The root cause is the module's failure to sufficiently check entity or field access and its lack of user input sanitization during the generation of iCal feeds. ...

CVE-2026-8495

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

CVE-2026-8495 Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

CVE-2026-8495: Missing Authorization

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15...

DRUPAL-CONTRIB-2026-037

This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds. This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no...