An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor...
CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A
#cwe-672
共收录 40 条相关情报。
← 返回所有主题An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access conti...
CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A
nebula-mesh: Certificate revocation is never enforced at the mesh
CVE-2026-61699
### Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that li
Sylius: Cart FormComponent allows modification or deletion of an already-completed order
CVE-2026-53637
### Impact A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `better
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an...
CVE-2026-58291
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker t
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-58291
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker t
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can contin...
CVE-2026-56314
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing d
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
# CurlAsyncHTTPClient leaks per-request credentials on handle reuse ## Summary `CurlAsyncHTTPClient` pools and reuses
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features...
CVE-2026-2379
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibi
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interfa...
CVE-2026-2379
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibi
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were vali...
CVE-2026-33463
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclos
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accep...
CVE-2026-42791
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a r...
CVE-2026-33278
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables de
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content t...
CVE-2026-32244
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit...
CVE-2026-4053
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fiel
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file...
CVE-2026-4053
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fiel
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with prev...
CVE-2026-45005
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to re
Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a se...
CVE-2013-10075
Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket ha...
CVE-2026-43585
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain vali