medium · CVSS v3 6.5

CVE-2026-76168

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can resu…

Description

In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Scores

Severity
medium
CVSS v2
5
CVSS v3
6.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-84164

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

View analysis

medium

CVE-2026-123291

JetBrains Datalore before 2026.4 contains an improper owner validation flaw that allows an authenticated user to read issues and notebook runs from other workspaces. This can expose sensitive operational data and potentially lead to data leakage. The vulnerability is rated medium severity.

View analysis

medium

CVE-2026-123308

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

View analysis