Tangled

Tangled Tangled is a phishing platform designed from an offensive security perspective. It automates many of the aspects of social engineering campaigns delivery and weaponizes iCalendar rendering features in Microsoft Outlook & Gmail Google Workspace to deliver spoofed meeting invites that are...

Updated libical package fixes security vulnerabilities

Denial of Service via crafted iCalendar property parsing. CVE-2026-88383 Heap Out-of-Bounds Read via icalvaluedecodeicalstring. CVE-2026-111269...

MGASA-2026-0553 Updated libical package fixes security vulnerabilities

Denial of Service via crafted iCalendar property parsing. CVE-2026-88383 Heap Out-of-Bounds Read via icalvaluedecodeicalstring. CVE-2026-111269...

CVE-2026-93627

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

CVE-2026-93628

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93629

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

CVE-2026-93629

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in calendar processing. An unauthenticated email sender can insert calendar invitations attributed to another user by exploiting a lack of verification for the iCalendar ORGANIZER identity...

CVE-2026-93629 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

EUVD-2026-108965

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

EUVD-2026-108964

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93628 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93628

The Zimbra Collaboration Suite (ZCS) version 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in the email calendar processing. The root cause is that the system passes a null sender identity when processing iCalendar REPLY components, which leads to the attendee authorization filte...

EUVD-2026-108963

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

CVE-2026-93627 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

CVE-2026-93627

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in the email calendar processing component. The root cause is that the system accepts iCalendar CANCEL and REQUEST components without verifying if the email sender is authorized to act as ...

PT-2026-122090

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email...

PT-2026-122092

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

PT-2026-122091

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728

Versions of Bulwark Webmail prior to 1.9.2 are vulnerable to a DNS-rebinding SSRF in the public POST /api/fetch-ical endpoint. The root cause is a check-then-fetch pattern where the application performs one DNS lookup for validation and a second lookup for the socket connection; an attacker contr...