Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

CVE-2026-93629

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

CVE-2026-93628

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93627

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

CVE-2026-93629

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in calendar processing. An unauthenticated email sender can insert calendar invitations attributed to another user by exploiting a lack of verification for the iCalendar ORGANIZER identity...

EUVD-2026-108965

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

EUVD-2026-108964

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93628

The Zimbra Collaboration Suite (ZCS) version 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in the email calendar processing. The root cause is that the system passes a null sender identity when processing iCalendar REPLY components, which leads to the attendee authorization filte...

CVE-2026-93627

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in the email calendar processing component. The root cause is that the system accepts iCalendar CANCEL and REQUEST components without verifying if the email sender is authorized to act as ...

EUVD-2026-108963

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

CVE-2026-113728

Versions of Bulwark Webmail prior to 1.9.2 are vulnerable to a DNS-rebinding SSRF in the public POST /api/fetch-ical endpoint. The root cause is a check-then-fetch pattern where the application performs one DNS lookup for validation and a second lookup for the socket connection; an attacker contr...

Fedora 44 : libical (2026-a76bba1412)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a76bba1412 advisory. Add a patch for CVE-2026-88383: Denial of Service via crafted iCalendar property parsing Tenable has extracted the preceding description block directly from...

CVE-2026-88383

A flaw was found in libical. When parsing calendar data containing parameterized properties, the library improperly invokes an internal search callback due to a function pointer mismatch. An attacker could exploit this vulnerability by providing specially crafted iCalendar data to an application...

Linux Distros Unpatched Vulnerability : CVE-2026-77399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fromical accepts an attacker-controlled...

CVE-2026-91024

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

EUVD-2026-85056

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91024: Improper Neutralization of Special Elements used in an SQL Command

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

PT-2026-97193

Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21 Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from a...

CVE-2026-77399

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fromical accepts an attacker-controlled VALARM REPEAT value and applications that request alarm times can eagerly expand it without an application-level limit. Alarms.times and...