Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: ayatana-webmail

Found 13 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-35542
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
An issue was discovered in Roundcube Webmail before 1.5.14 and …

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.

Affected products

Webmail
  • <1.6.14
  • <1.5.14

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2026-34833
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
Bulwark Webmail: Information Exposure: password returned in /api/auth/session

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

Affected products

webmail
  • ==< 1.4.10

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2026-34834
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

Affected products

webmail
  • ==< 1.4.10

Matching in nixpkgs

Package maintainers