CVE-2026-47044 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to cause a denial of service by hanging or crashing the application. The vulnerability affects the core component of Oracle VM VirtualBox. There is no indication of known exploits in the wild. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but recommends applying security patches promptly for all Oracle products.
CVE-2026-47043 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 and several older versions. It allows a highly privileged local attacker to gain unauthorized read access to certain data within the product. The vulnerability impacts confidentiality but does not affect integrity or availability. There is no explicit patch or remediation information provided in the available data. Oracle's advisory does not specifically mention this vulnerability or its patch status. No known exploits in the wild have been reported.
CVE-2026-47041 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a highly privileged attacker with logon access to cause a denial of service by hanging or crashing the software. The vulnerability affects the core component and may impact additional products due to scope changes. The CVSS 3.1 base score is 6.0, indicating a medium severity with availability impact only. There are no known exploits in the wild. The vendor advisory references a Critical Patch Update that includes multiple patches, but no explicit patch information for this specific vulnerability is provided in the advisory content.
CVE-2026-58624 is an improper input validation vulnerability in the GitPgmCommandFactory component of Apache MINA SSHD, a Java SSH library. It allows authenticated SSH users to execute arbitrary JGit commands, including those that can write files on the server, such as git archive with the --output option. The vulnerability affects SSH servers using Apache MINA SSHD with GitPgmCommandFactory configured. It is fixed in versions 2.19.0 and 3.0.0-M5 by restricting commands to a safe whitelist and ignoring the --output argument for git archive.
Apache MINA SSHD server versions prior to 2.19.0 and 3.0.0-M5 improperly validated OpenSSH user certificates during authentication. Specifically, the server did not check for unsupported force-command or verify-required options in user certificates, allowing users with certificates containing a force-command option to authenticate but potentially execute other commands depending on server implementation. This vulnerability has been fixed by rejecting such certificates in the specified fixed versions.
CVE-2026-56623 is a path traversal vulnerability in the Apache MINA SSHD component sshd-git on Windows. It allows an authenticated remote user to access git repositories outside the configured server-side root directory due to ineffective path validation in versions 2.18.0 and 3.0.0-M4. The issue affects applications using sshd-git on Windows and is fixed in versions 2.19.0 and 3.0.0-M5.
A path traversal vulnerability exists in the sshd-scp component of Apache MINA SSHD, a Java library for SSH. The flaw allows a malicious sender to craft filenames with paths in SCP 'C' or 'D' commands, causing files to be written to attacker-controlled locations. This affects applications using unsupported Apache MINA SSHD versions prior to 2.0.0 with SCP receive functionality, and those using sshd-scp in versions 2.0.0 and later. The issue is fixed in Apache MINA versions 2.19.0 and 3.0.0-M5. Users are advised to upgrade to these versions to mitigate the risk.
CVE-2026-62318 is a medium severity vulnerability affecting multiple specific versions of the Netatalk software, primarily distributed in various Ubuntu package versions. The exact nature and technical details of the vulnerability are unknown based on the provided data.
CVE-2026-62319 is a medium severity vulnerability affecting multiple specific versions of the Netatalk software. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No known exploits in the wild have been reported. The affected versions are explicitly listed and pertain to various Ubuntu package versions of Netatalk.
CVE-2026-62320 is a medium severity vulnerability affecting specific versions of Netatalk, a network file sharing software. The vulnerability details and technical description are unknown. Multiple Ubuntu package versions of Netatalk are affected. No CVSS score or detailed impact information is available. There are no known exploits in the wild and no vendor patch or remediation information provided.
CVE-2026-62321 is a medium severity vulnerability affecting multiple specific versions of Netatalk, an open-source AFP (Apple Filing Protocol) server. The exact nature and technical details of the vulnerability are unknown based on the provided information. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported. The affected versions are explicitly listed, primarily various builds of Netatalk 2.2.2 through 2.2.6 on Ubuntu platforms. No patch or remediation information is provided, so the patch status is not confirmed.
Cyrus IMAP versions up to 3.12.2 have a vulnerability where the LISTRIGHTS command is not properly restricted to admin users. Authenticated users can query access rights on any mailbox they can name, potentially revealing which principals have access to that mailbox. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Cyrus IMAP versions up to 3.12.2 have a heap exposure vulnerability in nested MIME comment parsing. An authenticated IMAP user can craft an email with an RFC 822 comment ending with a backslash, causing the server to read beyond the message's end in memory and disclose heap contents. The vulnerability has a medium severity with a CVSS score of 3.1.
Cyrus IMAP versions up to 3.12.2 have a vulnerability in the URLAUTH feature where revoked authorizer access is not enforced. URLs created while the authorizer had access remain valid even after access revocation, potentially allowing unauthorized continued access. The vulnerability is rated medium severity with a CVSS score of 3.5.
Cyrus IMAP versions through 3.12.2 have a vulnerability allowing authenticated users to generate URLAUTH tokens for any mailbox, bypassing access control lists. This enables unauthorized reading of mailboxes without explicit permission. The vulnerability affects multiple specific versions of cyrus-imapd and has a medium severity rating based on a CVSS score of 3.5.
Cyrus IMAP versions through 3.12.2 have a vulnerability in the cyrus-imapd component where URLAUTH token forgery is possible due to a missing mailbox key. An attacker who knows a folder name on a victim's account can forge a valid URLAUTH token by computing an HMAC-SHA1 with a predictable key, granting read access to the mailbox. The URLAUTH feature is obscure and likely not widely used, which reduces the practical risk of exploitation.
Cyrus IMAP versions up to 3.12.2 have a vulnerability where the LOCALDELETE command bypasses access control list (ACL) checks. This flaw allows an authenticated non-admin user to execute the admin-only LOCALDELETE IMAP command, enabling deletion of mailboxes without proper permissions. The vulnerability has a medium severity rating with a CVSS score of 6.5.
Cyrus IMAP versions up to 3.12.2 have a vulnerability in the cyrus-imapd component where an authenticated IMAP user can use the ESEARCH command to enumerate folder names under any account. This vulnerability allows cross-user information disclosure by revealing UIDs of messages matching the search criteria, but does not permit reading the actual message content. The issue is rated medium severity with a CVSS score of 4.3.
Cyrus IMAP versions through 3.12.2 have a vulnerability in the vacation "fcc" feature that allows bypassing mailbox ACLs. This flaw permits a user with a vacation Sieve script using :fcc to save copies of sent messages into any mailbox named by the script, regardless of insert permissions. The vulnerability has a medium severity with a CVSS score of 5.4.
A stack-based buffer overflow vulnerability exists in libsolv's PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths, potentially causing a denial of service during automated package or repository processing.