https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T18:55:35.335262+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-33515 CVE-2021-33515 2026-10-15T18:55:35.336959+00:00

The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.

 https://cve.radiocsirt.org/vuln/usn-4993-1 USN-4993-1 — dovecot vulnerabilities 2026-10-15T18:55:35.337003+00:00

Affected: Ubuntu:20.04:LTS: dovecot

Kirin discovered that Dovecot incorrectly escaped kid and azp fields in JWT tokens. A local attacker could possibly use this issue to validate tokens using arbitrary keys. This issue only affected Ubuntu 20.10 and Ubuntu 21.04. (CVE-2021-29157)

Fabian Ising and Damian Poddebniak discovered that Dovecot incorrectly handled STARTTLS when using the SMTP submission service. A remote attacker could possibly use this issue to inject plaintext commands before STARTTLS negotiation. (CVE-2021-33515)