Total
125 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-75010 | 1 Roundcube | 1 Webmail | 2026-09-08 | N/A | 6.4 MEDIUM |
| In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver. | |||||
| CVE-2026-31431 | 10 Amazon, Arista, Canonical and 7 more | 60 Amazon Linux, Cloudvision Agni, Cloudvision Portal and 57 more | 2026-09-08 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. | |||||
| CVE-2026-73574 | 1 Synacor | 1 Zimbra Collaboration Suite | 2026-08-28 | N/A | 3.1 LOW |
| In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet. | |||||
| CVE-2020-1048 | 1 Microsoft | 8 Windows 10, Windows 7, Windows 8.1 and 5 more | 2026-08-19 | 7.2 HIGH | 7.8 HIGH |
| An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system. | |||||
| CVE-2021-30120 | 1 Kaseya | 1 Vsa | 2026-08-14 | 5.0 MEDIUM | 9.9 CRITICAL |
| Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in. | |||||
| CVE-2026-35543 | 1 Roundcube | 1 Webmail | 2026-07-24 | N/A | 5.3 MEDIUM |
| An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass. | |||||
| CVE-2026-35542 | 1 Roundcube | 1 Webmail | 2026-07-24 | N/A | 5.3 MEDIUM |
| An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass. | |||||
| CVE-2026-35544 | 1 Roundcube | 1 Webmail | 2026-07-24 | N/A | 5.3 MEDIUM |
| An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important. | |||||
| CVE-2026-35545 | 1 Roundcube | 1 Webmail | 2026-07-24 | N/A | 5.3 MEDIUM |
| An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke. | |||||
| CVE-2026-35540 | 1 Roundcube | 1 Webmail | 2026-07-24 | N/A | 5.4 MEDIUM |
| An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. | |||||
| CVE-2026-42997 | 1 Openstack | 1 Ironic | 2026-07-24 | N/A | 7.7 HIGH |
| An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1. | |||||
| CVE-2026-48845 | 2026-07-24 | N/A | 6.5 MEDIUM | ||
| In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message. | |||||
| CVE-2026-48846 | 2026-07-24 | N/A | 6.5 MEDIUM | ||
| In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass. | |||||
| CVE-2026-48847 | 2026-07-24 | N/A | 3.7 LOW | ||
| Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass. | |||||
| CVE-2026-48831 | 2026-07-23 | N/A | N/A | ||
| Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine). | |||||
| CVE-2026-12068 | 2026-07-23 | N/A | 7.4 HIGH | ||
| Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux. | |||||
| CVE-2026-46447 | 1 Openstack | 1 Ironic | 2026-07-22 | N/A | 5.8 MEDIUM |
| OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info. | |||||
| CVE-2026-44917 | 1 Openstack | 1 Ironic | 2026-07-22 | N/A | 4.9 MEDIUM |
| OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template. | |||||
| CVE-2026-40228 | 1 Systemd Project | 1 Systemd | 2026-06-17 | N/A | 2.9 LOW |
| In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | |||||
| CVE-2026-40225 | 1 Systemd Project | 1 Systemd | 2026-06-17 | N/A | 6.4 MEDIUM |
| In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. | |||||