CVE-2026-42395

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...

CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

PT-2026-83053

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can cause a denial of service for Sieve script management by sending a small malformed command before authentication, which crashes the ManageSieve login process. The...

UBUNTU-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

UBUNTU-CVE-2026-40019

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...

UBUNTU-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

UBUNTU-CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-40019

An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...

PT-2026-83051

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description A crash can occur in the submission-login process when the mail max userip connections limit is reached, resulting in an epoll panic due to file descriptor handling issues. In high-security mode,...

PT-2026-83070

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description A host configured as a trusted proxy can send forwarding information containing a NUL byte. This causes the login process to crash during the subsequent login attempt, leading to process...

CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

PT-2026-83067

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can send an IMAP ID command containing an excessive number of parameters before authentication. This action causes disproportionate growth in memory and CPU usage,...

UBUNTU-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

CVE-2026-78617

WatchGuard Dimension 's web login endpoint does not enforce effective rate-limiting or account lockout by default, allowing a remote attacker to perform automated password guessing (brute-force) against user accounts. The root cause is the absence of default protections against repeated authentic...

CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

GHSA-G7GW-M874-7RMF Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...

EUVD-2026-28857

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...

EUVD-2026-67047

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

PT-2026-82592

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate server URLs within the login and register with email functions, allowing the use of unconfigured hosts and unencrypted http:// URLs. This allows attackers...