CVE-2026-100389: Unrestricted Upload of File with Dangerous Type

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

thunderbird: Information disclosure due to malicious IMAP server response

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js...

thunderbird: Out-of-bounds read in IMAP response parser

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...

thunderbird: Thunderbird: Out-of-bounds read via maliciously constructed IMAP line

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed Internet Message Access Protocol IMAP line. This could lead to an out-of-bounds buffer read, potentially resulting in information disclosure or a denial of service...

[SECURITY] Fedora 44 Update: cyrus-imapd-3.12.4-1.fc44

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

[SECURITY] Fedora 45 Update: cyrus-imapd-3.12.4-1.fc45

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

A library for client-side APIs for the IMAP protocol, written in Ruby. This issue involves insufficient checking of unusual or exceptional states, allowing attackers to execute “man-in-the-middle” attacks.

The vulnerability in the client API library for the IMAP protocol, written in Ruby, relates to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

A library error related to the client API for the IMAP protocol, written in Ruby. This issue arises from the failure to properly handle CRLF sequences, allowing attackers to execute arbitrary IMAP commands.

The vulnerability in the client API library for the IMAP protocol in Ruby is related to the failure to implement measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary IMAP commands remotely...

[SECURITY] Fedora 44 Update: dovecot-2.4.5-1.fc44

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

[SECURITY] Fedora 43 Update: dovecot-2.4.5-1.fc43

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

[SECURITY] Fedora 45 Update: dovecot-2.4.5-1.fc45

Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mail in either of maildir or mbox formats. The SQL drivers and authentication plug-ins are in their subpackages...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-3768)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-3721)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

[SECURITY] Fedora 45 Update: roundcubemail-1.7.4-1.fc45

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-3796)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-3821)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a...

CVE-2026-92239

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed Internet Message Access Protocol IMAP line. This could lead to an out-of-bounds buffer read, potentially resulting in information disclosure or a denial of service...

SUSE CVE-2026-92239

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

SUSE CVE-2026-92240

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and...