Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-52584] Information disclosure via Buffer Overflow in DecodeImageAPNG function
Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function A flaw was found in libjxl. The flaw occurs within the `DecodeImageAPNG` function, which can lead to unauthorized disclosure of data. Red Hat ships libjxl as a bundled component within Firefox and Thunderbird. The vulnerable code path is in the APNG decoder (DecodeImageAPNG), which is part of the extras module used by command-line tools. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-13713] YAML::Syck: Denial of Service via crafted YAML document
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted YAML document. This Important vulnerability in `perl-YAML-Syck` can lead to a denial of service when processing untrusted YAML documents. The flaw, a use-after-free and double-free, causes the interpreter to crash if a specially crafted YAML document redefines an anchor during parsing. This poses a risk to Red Hat systems that handle external YAML input without sufficient validation. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
High [CVE-2026-5674] Sandbox escape and arbitrary code execution via malicious library loading
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. Important: This flaw in PipeWire allows for a sandbox escape, enabling arbitrary code execution outside of sandboxed environments, such as Flatpak applications, when minimal permissions are granted. Red Hat products utilizing PipeWire's PulseAudio compatibility layer are susceptible, as an attacker can load a malicious library from within a sandboxed process, bypassing isolation mechanisms. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-427. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected. Affected products named by the advisory: Red Hat package: pipewire.
High [CVE-2026-15925] Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. Users must manually upgrade. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-53366] account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. A flaw was found in the Linux kernel's handling of IPv4 network packets. An error in how the kernel accounts for fragmented data during memory allocation can lead to an undersized memory buffer. This memory handling issue could potentially be exploited by a remote attacker to cause a system crash or denial of service. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-131. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-57077] YAML::Syck: YAML::Syck: Information disclosure via out-of-bounds read
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read. An out-of-bounds read vulnerability exists due to an unbounded newline scan during block-scalar lexing. A remote attacker could exploit this by providing a specially crafted YAML document, leading to potential information disclosure. This issue is an incomplete fix for a previously identified vulnerability. Moderate: An out-of-bounds read flaw in `perl-YAML-Syck` can lead to information disclosure when processing specially crafted YAML documents. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Medium [CVE-2026-57076] YAML::Syck: Heap use-after-free via anchor name reuse
YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory. An attacker could exploit a heap use-after-free vulnerability by providing a specially crafted YAML document that reuses an anchor name as an anchors-table key. This flaw causes the software to read freed heap memory, which may lead to information disclosure or denial of service. This Important heap use-after-free vulnerability in `perl-YAML-Syck` can be triggered by processing a specially crafted YAML document. The flaw, exploitable through the default YAML loading mechanism, may lead to information disclosure or a denial of service in applications handling untrusted YAML input. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-57075] YAML::Syck: YAML::Syck: Information disclosure via out-of-bounds read in base64 decoder
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any!!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any!!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document containing a!!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result. An out-of-bounds read vulnerability exists in the base64 decoder, specifically in the `syck_base64dec` function. This occurs because the decoder uses a signed character to index a lookup table, allowing specially crafted `!!binary` YAML nodes with high-bit bytes to cause a read beyond the intended memory region. A remote attacker could exploit this by providing a malicious YAML document, potentially leading to information disclosure. This Moderate impact flaw in `perl-YAML-Syck` can lead to information disclosure. Exploitation requires an application to parse a specially crafted YAML file, making the impact dependent on the application's handling of untrusted input.
Medium [CVE-2026-46338] Information disclosure via crafted Markdown snippets
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3. A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system. By crafting a special Markdown snippet, an attacker could trick the system into accessing files outside of the intended directory, leading to unauthorized information disclosure. This issue requires user interaction, meaning a user would need to process a malicious Markdown file for the attack to succeed. Red Hat ships pymdown-extensions in several products as a bundled dependency. The vulnerability requires an attacker to control Markdown content processed by the pymdownx.snippets extension and for sibling directories with a matching path prefix to exist. Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires an authenticated attacker with specific delegated administrative permissions and the non-default FGAP v2 feature to be enabled. Successful exploitation allows an attacker to disclose sensitive metadata and configuration details of parent groups they are otherwise restricted from viewing. The vulnerability's root cause is a failure to apply fine-grained access control filters to parent groups during hierarchical search result construction. Weakness: CWE-639. Affected Red Hat products: Red Hat Build of Keycloak; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-45695] Arbitrary code execution via unauthenticated SFTP configuration in HTTP server.
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob. NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand= can cause exec. CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0. This allows the attacker to forward malicious SFTP storage configurations, which can lead to arbitrary code execution through OpenSSH commands. Red Hat Product Security considers this bug as Moderate as this requires active change of out of box configaration for this bug to be exploitable. There is no common use case under which Kopia HTTP server should be started without a password. The diecrepancy in CVSS scores between Red Hat and NVD comes from the differences in User Interaction, Integrity and Availability. The core bug is merely an unintended information disclosure problem if exploited correctly. There is no way to launch a denial of service or affect the integrity of the service. Therefore the bug is scored lower. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-78.
Medium [CVE-2026-47085] Information disclosure via URLAUTH token forgery
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.) A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. The likelihood of exploitation is low due to the obscurity of the URLAUTH feature. Red Hat severity: Moderate — CVSS 4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-341. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47084] Unauthorized mailbox deletion via ACL bypass
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized data integrity compromise. This Moderate flaw in Cyrus IMAP allows an authenticated user to bypass Access Control List (ACL) restrictions, enabling unauthorized mailbox deletion. The impact is considered Moderate as it requires prior authentication and specific command usage, limiting exploitation to existing users. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-266. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47082] ACL bypass in vacation 'fcc' feature allows unauthorized mailbox writes
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user with low privileges can exploit a vulnerability in the vacation "fcc" feature. By crafting a specific Sieve script, the user can bypass access control lists and deliver vacation auto-reply messages into any mailbox, leading to unauthorized modification of mailbox content. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-279. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47083] Information disclosure via ESEARCH command
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content). An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other users' mailboxes. While it does not permit arbitrary content reads, this vulnerability could expose the structure of other users' mailboxes, potentially aiding further reconnaissance. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-201. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47089] Information disclosure via LISTRIGHTS
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user can exploit this vulnerability by using the IMAP LISTRIGHTS command. This allows the user to learn the access permissions of any mailbox they can name, which should be restricted to administrators. This leads to unauthorized information disclosure regarding mailbox access controls. While requiring prior authentication, this bypasses intended administrative restrictions, potentially exposing sensitive access control configurations within a Red Hat deployment. The impact is limited to information disclosure and does not grant further privileges or data modification. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-266. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47086] Information disclosure via URLAUTH token bypass of Access Control Lists
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions. This allows bypassing Access Control Lists (ACLs), which are rules that control access to mailboxes. Consequently, an attacker could read mail from any mailbox, even without having been granted explicit read permissions. This flaw in cyrus-imapd allows an authenticated attacker to bypass Access Control Lists (ACLs) by minting a URLAUTH token via the GENURLAUTH command. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47081] Information disclosure of mailbox existence via XAPPLEPUSHSERVICE command
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed. While no content is leaked, this constitutes an information disclosure regarding the existence and activity of other users' mailboxes. Red Hat severity: Low — CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-497. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47088] Information disclosure via heap exposure in MIME comment parsing
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user. By crafting an email message with a specially formed RFC 822 comment, the server could be made to read beyond the message's boundary in memory, potentially disclosing sensitive heap content to the attacker. Red Hat severity: Low — CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47087] Unauthorized access due to URLAUTH not honoring revoked authorizer access
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. This allows a previously authorized user to retain access via a URLAUTH URL, even after their authorization has been revoked, potentially leading to unauthorized information disclosure. Red Hat severity: Low — CVSS 3.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-613. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.