CVE Watch16 jul 2026

CVE-2026-47088

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated

CVSS

3.1

Bajo

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 16 jul 2026 · Última mod.: 16 jul 2026 · CWE-126

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-256468.1 ALT

57.4%

——17LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.2d CVE-2026-52608.2 ALT

50.0%

——15A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.1d CVE-2026-504686.5 MED

49.6%

——15Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.2d CVE-2026-504456.5 MED

47.7%

——14Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.1d CVE-2026-505046.5 MED

46.4%

——14Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.2d CVE-2026-441857.3 ALT

44.6%

——13Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.15h