58608 matches found
CVE-2026-49217
Mailu , a mail server distributed as Docker images, is affected by a missing authorization check in its admin REST API prior to version 2024.06.52 . When the REST API is enabled, an unauthenticated remote attacker can remove IP restrictions or modify the comment field on any existing user token v...
EUVD-2026-63743
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
CVE-2026-72843
EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...
CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
EUVD-2026-63713
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...
CVE-2026-49244
SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...
CVE-2026-54509
TREK (collaborative travel planner) versions 3.0.0 through 3.1.0 contain an IDOR vulnerability in the GET /api/journeys/:id/share-link route. The endpoint returns a journey share token without verifying that the authenticated requester owns or has access to the target journey. Because journey IDs...
CVE-2026-65801 Microsoft Exchange Online Elevation of Privilege Vulnerability
...
CVE-2026-65801
CVE-2026-65801 is a critical (CVSS 3.1: 10.0) server-side request forgery (SSRF) vulnerability in Microsoft Exchange Online that allows an unauthorized, unauthenticated attacker to elevate privileges over a network . The attack requires no user interaction, no prior privileges, and has low comple...
CVE-2026-46355 BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active...
CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...
CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...
CVE-2026-67447 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...
CVE-2026-39987
CVE-2026-39987 — RCE pre-autenticazione in Marimo CVE-2026-39987 è una vulnerabilità critica di Remote Code Execution RCE pre-autenticazione che colpisce Marimo, un ambiente notebook Python reattivo. La vulnerabilità risiede nell'endpoint WebSocket del terminale di Marimo: root@kitploit:...
EUVD-2026-63663
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...
EUVD-2026-63661
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...
CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...
CVE-2026-43798
A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1...
CVE-2026-43798
CVE-2026-43798 affects swift-nio-ssh , the SSH implementation in Apple's Swift NIO networking library. A single crafted SSH message allows an unauthenticated network attacker to trigger an out-of-bounds stack write with attacker-controlled length and content, potentially affecting any application...
