CVE-2026-86009
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-285 · CWE-863
Not enough EPSS history yet.
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-172753.7 LOW—
———IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.6hCVE-2026-170685.4 MED—
———IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.6hCVE-2026-1116884.3 MED—
———Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.7hCVE-2026-1116664.3 MED—
———Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.7hCVE-2026-1116277.2 HIG—
———HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.7hCVE-2026-1095878.8 HIG—
———Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.6h