CVE Watch16 de set. de 2026

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some sh

CVSS

3.5

Baixa

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Publicado: 9 de set. de 2026 · Última mod.: 16 de set. de 2026 · CWE-420

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-112026-11-08

Descrição técnica

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1050089.0 CRÍ

52.0%

——16No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.13d CVE-2026-1021345.4 MÉD

11.1%

——3Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.39d CVE-2026-776395.3 MÉD

33.4%

——10Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.22d CVE-2026-404355.3 MÉD

13.6%

——4When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.14d CVE-2026-402178.8 ALT

97.1%

——29LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.14d CVE-2026-353882.5 BAI

2.8%

——1OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.108d