162978 matches found
CVE-2026-42392
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42007
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...
CVE-2026-40205
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...
CVE-2026-40204
None None None No publicly available exploits are known...
CVE-2026-40203
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...
CVE-2026-40019
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the...
CVE-2026-40018
None None None No publicly available exploits are known...
CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...
CVE-2026-40015
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause...
CVE-2026-40014
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...
CVE-2026-40013
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...
CVE-2026-33607
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...
CVE-2026-33606
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...
CVE-2026-33605
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...
CVE-2026-33263
When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...
CVE-2026-33604
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...
CVE-2026-27852
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit...
CVE-2026-18393
A flaw was found in FFmpeg. The tdscloadcursor function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code...
CVE-2026-18918
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided "AbstractAdapterCredentialsFilter", are vulnerable. An attacked can create a...
CVE-2026-78072
Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...
MSC-2026-11519
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-11520
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82089
The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...
CVE-2026-38822
In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...
CVE-2026-38821
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...
CVE-2026-38820
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...
CVE-2026-38819
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes...
CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
CVE-2026-38093
filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...
WS-2026-0032
The NumpyReader class in monai/data/imagereader.py unconditionally calls np.loadname, allowpickle=True, enabling arbitrary code execution when loading a crafted .npy or .npz file. The allowpickle parameter was hardcoded to True and could not be overridden by the caller, and NumpyReader is selecte...
WS-2026-0042
Affected versions of Winter CMS did not enforce the ImportExportController behavior granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys enforced by...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-38636
An issue in the seekdir function /dirent/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-37710
Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...
WS-2026-0031
NocoBase is vulnerable to authenticated remote code execution through two chained flaws in the server package. An authenticated admin can supply an unsanitized documentRoot value to the storages:update API to redirect the file-upload storage root to an arbitrary path on disk, including the...
CVE-2026-37751
An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...
WS-2026-0035
MeshCentral stores the agent-supplied osdesc OS description field from the coreinfo message with no HTML sanitization, and renders it into the admin device details panel via innerHTML. A rogue or compromised MeshAgent can therefore inject arbitrary HTML and JavaScript that executes in the browser...
WS-2026-0033
MONAI is vulnerable to OS command injection in monai/apps/nnunet/nnunetv2runner.py. The runner concatenates user-controlled values from a configuration YAML datasetnameorid or CLI kwargs into a command string without quoting or validation, and the string is passed to subprocess with shell=True, s...
WS-2026-0041
SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields, each up to 65535, directly from an attacker-controlled SCTP SACK chunk and loops that many times reading four bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...
WS-2026-0036
Multiple legacy PHP template files in LibreNMS output SNMP-sourced and syslog-sourced data into HTML without escaping. The syslog program field is emitted unescaped in includes/html/print-syslog.inc.php while the adjacent msg field is escaped, so an attacker who controls a monitored network devic...
WS-2026-0040
TurnServer.ReceiveUdpAsync places its generic catch Exception outside the while receive loop, and Start launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in the range 0x80 to 0xFF causes...
WS-2026-0039
A malicious, compromised, or man-in-the-middle PostgreSQL server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs the key derivation inline with no upper bound, pinning a tokio worker thread for minutes per connection and possibly stallin...
CVE-2026-51376
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...
WS-2026-0037
The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an...
WS-2026-0034
The algofrompickle function in monai/auto3dseg/utils.py deserializes attacker-controlled data with pickle.loads at three call sites, with isinstance and key validation performed only after deserialization, so remote code execution fires before any check. An earlier advisory stated the issue was...