今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表CVE-2026-73209
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its
CVE-2026-73208
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th
CVE-2026-5510
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-52687
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression st
CVE-2026-52681
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the acco
CVE-2026-42395
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process
CVE-2026-42393
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the confi
CVE-2026-42392
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to b
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentica
CVE-2026-40205
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more tha
CVE-2026-40204
None None None No publicly available exploits are known.
CVE-2026-40203
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes
CVE-2026-40019
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin i
CVE-2026-40018
None None None No publicly available exploits are known.
CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal ha
CVE-2026-40015
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands
CVE-2026-40014
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU dispr
CVE-2026-40013
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an