Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.3 | CVE-2026-114731 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain an uncontrolled resource consumption flaw in the CSS proxy (the utils/modcss action). The advisory does not state a severity rating for this specific CVE, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5, which the advisory indicates are the fixed releases. Technical summaryThe flaw is classed as uncontrolled resource consumption in the CSS proxy utils/modcss action of Roundcube Webmail. The advisory states the fix is a size limit added to the CSS proxy content processing, in upstream 1.6.20 and 1.7.5. Attack vector and preconditions are not stated in this advisory. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. Debian package versions referenced include roundcube/1.6.19+dfsg-1, roundcube/1.6.19+dfsg-0+deb13u1 and roundcube/1.6.5+dfsg-1+deb12u12 as found versions, with roundcube/1.6.20+dfsg-1 as the fixed Debian version. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-114730 |
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Executive summaryRoundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 are affected by a server-side request forgery filter bypass, and the advisory is tied to a larger batch of fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this CVE. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later, as the upstream and Debian updates indicate. Technical summaryThe flaw is a server-side request forgery (SSRF) filter bypass in the is_local_url() check, which the advisory says can be bypassed via the NAT64 64:ff9b::/96 prefix. The advisory does not state the attack vector details, required privileges, or user interaction beyond this description. Affected versions are stated as 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 as written. Debian's bug report lists found versions 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1, and fixed version 1.6.20+dfsg-1. No CVSS score, workaround, or exploitation status is stated, and no detection guidance is given for this specific CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114729 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a remote content blocking bypass, as well as a set of other security fixes released together in the same update. The advisory does not state a severity rating for this specific CVE, and the Debian bug report lists the overall batch as important. The recommended action is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in Roundcube, reported as a bypass via SVG SMIL by attribute, which lets remote content get past the blocker in HTML messages. The advisory does not describe the attack vector in detail beyond this, and preconditions are not stated. Fixed versions are given as 1.6.20 and, per the title, 1.7.5 for the 1.7.x branch; the Debian package fix is 1.6.20+dfsg-1. Affected Debian versions listed are 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114728 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that lets remote content bypass blocking, which is a privacy concern for webmail users. The advisory does not state a severity score, and the Debian bug report lists its severity as important. The vendor's fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in the handling of FuncIRI attributes, caused by CSS escapes, and the advisory describes it as a repeat fix. The advisory does not state the attack vector details, required user interaction, or privileges. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and fixed versions are 1.6.20 and 1.7.5. Debian's package versions listed were 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1, and 1.6.5+dfsg-1+deb12u12, with fix 1.6.20+dfsg-1. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-114727 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Debian, ImageMagick, RoundcubeImageMagick, Roundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw where potentially unsafe attachment content is passed into ImageMagick when images are resized. The advisory does not state a severity rating for this specific issue, but the Debian bug report that tracks the batch of fixes is marked important. The fix is to update Roundcube to 1.6.20 or 1.7.5 or later, as the upstream release notes recommend. Technical summaryThe flaw is described as passing potentially unsafe content into ImageMagick during image resizing, which is an unsafe handling of attachment data. The advisory does not state the attack vector, required privileges or user interaction, or a CVSS score. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 per the advisory text. Debian's tracker lists fixed package version 1.6.20+dfsg-1 and found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L AffectsDebianImageMagickRoundcubeImageMagickRoundcube WebmailDebian roundcube
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.8 | CVE-2026-114726 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a mail header injection flaw in the Bounce (resend) action, which is one of a batch of security fixes released together. The advisory does not state a severity score for this specific CVE, though the Debian bug report is marked important. The recommended remedy is to update to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a mail header injection in the Bounce (resend) action of Roundcube Webmail, fixed via a change to the From display-name handling. The advisory names affected versions as before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. Attack vector, required privileges, and user interaction are not stated. No workaround is stated, and no CVSS score or exploitation status is stated. Detection guidance is not stated. The advisory notes that the CVE ID for this issue is CVE-2026-114726, assigned as the Bounce action header injection item in a batch fix list. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.4 | CVE-2026-114724 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Executive summaryThis advisory concerns Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5, where an object injection flaw in session handling is described. The advisory does not state a severity rating for this specific CVE, but the Debian bug report lists the related batch as important, and the fix is to upgrade to Roundcube 1.6.20 or 1.7.5. Technical summaryThe flaw is an object injection primitive in rcube_session::unserialize(), triggered by session keys with a "!" prefix, per the advisory text. The advisory does not state the attack vector, required privileges, or exploitation status. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1 with found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. The advisory does not state a CVSS score, a workaround, or detection guidance for this issue. The Debian report says the fix is in the upstream 1.6.20 release, and the upgrade is the recommended remediation. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-114722 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a CSS scoping bypass in HTML messages, which the advisory describes as part of a larger batch of security fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this specific flaw, and the upstream fix is to update to the patched release. Technical summaryThe flaw is a CSS scoping bypass in how HTML messages are rendered, fixed by a commit described as using at-rules. The advisory does not state the attack vector, required user interaction, or privileges. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. A workaround is not stated, and no CVSS score or exploitation status is given. Detection guidance is not stated. The Debian report lists this CVE among a batch of related fixes in the same release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 3.1 | CVE-2026-114721 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114721Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that allows the disabled_actions configuration setting to be bypassed. The advisory does not state a severity rating for this specific issue, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to update to Roundcube 1.6.20 or 1.7.5, as the advisory and linked release notes indicate. Technical summaryThe flaw is a bypass of the disabled_actions configuration setting, which the advisory attributes to deprecated action aliases that were not checked against the setting. The advisory does not state the attack vector, required privileges, or user interaction needed. Affected versions are stated as Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5, and the Debian report lists found versions roundcube/1.6.5+dfsg-1+deb12u12, roundcube/1.6.19+dfsg-1, and roundcube/1.6.19+dfsg-0+deb13u1, with fixed version roundcube/1.6.20+dfsg-1. No workaround, CVSS score, detection guidance, or exploitation status is stated for this issue. The same batch of upstream fixes includes many other flaws, but this advisory concerns only the disabled_actions bypass. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-114720 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114720Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a set of security flaws, including an IMAP command injection issue, that the advisory describes as a batch of multiple vulnerabilities. The advisory does not state a severity score for the issue, and the Debian bug report that it draws on rates the batch as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, or to the fixed Debian package 1.6.20+dfsg-1. Technical summaryThe advisory's headline describes an IMAP command injection caused by CRLF characters in parameters, which the Debian report ties to the _uid parameter of mail/headers and mail/viewsource and to the _flag parameter of the mail/mark action. The Debian report lists many other fixes, including SSRF filter bypass, remote content blocking bypass, mail header injection, XSS, CSRF bypass, and object injection in rcube_session::unserialize(), and it associates CVE IDs from CVE-2026-114714 through CVE-2026-114732 and CVE-2026-113386 with these items. Affected versions are stated as roundcube 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12, and the fixed version is stated as 1.6.20+dfsg-1; the upstream fix version for the 1.7.x branch is stated only as 1.7.5 in the Debian report's reference to upstream release notes. Attack preconditions, authentication requirements, CVSS scores, exploitation status, and detection guidance are not stated. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.7 | CVE-2026-114718 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114718Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a cross-site scripting flaw in the password plugin. The advisory is part of a larger batch of Roundcube security fixes described in a Debian bug report, and the fixes are shipped in upstream release 1.6.20 and 1.7.5. The advisory does not state a severity score for this specific CVE. Technical summaryThe flaw is a cross-site scripting (XSS) issue in handling of password driver error responses in the Roundcube password plugin, per the upstream fix list quoted in the Debian bug report. The advisory does not state the attack vector or user interaction required, nor a CVSS score. Fixed versions are stated as Roundcube 1.6.20 (Debian package roundcube/1.6.20+dfsg-1) and 1.7.5 for the 1.7.x branch. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. The advisory does not state any workaround or detection guidance for this issue. The Debian report lists the same fix as part of a batch of many other issues, and the CVE mapping in the report links this XSS fix to CVE-2026-114718. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.5 | CVE-2026-114716 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a mail header injection vulnerability, and it is part of a larger batch of security fixes in the Debian bug report. The advisory does not state a severity score for this CVE, and it describes the Debian bug as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, and Debian has shipped roundcube 1.6.20+dfsg-1 for this batch. Technical summaryThe CVE entry describes a mail header injection flaw in Roundcube Webmail. The Debian bug report lists the CVE-2026-114716 mapping to a fix titled 'mail header injection via media type in an inline image data URI', which is one of 19 fixes in the 1.6.20 release, and the report links the CVE to that commit. Versions before 1.6.20 and 1.7.x before 1.7.5 are stated as affected, and the fixed versions are 1.6.20 and 1.7.5, with Debian's fixed package named roundcube/1.6.20+dfsg-1. The advisory does not state the attack vector, required privileges, or user interaction needed. It does not state a CVSS score, workarounds, or detection guidance, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6583-1 |
libheif security update
DebianDebian Linux, Debian libheif
|
Debian Security Advisories | |||
|
DSA-6583-1libheif security update
Executive summaryDebian has released a security update for libheif, a library used to read and write HEIF and AVIF images. The advisory says that processing specially crafted images could cause denial of service or disclosure of process memory, and it recommends upgrading libheif packages. Technical summaryThe advisory describes multiple security issues in libheif, including denial of service through excessive resource consumption or crashes and disclosure of process memory when processing crafted images. It also addresses a use-after-free and double-free in timestamp handling during image encoding, including transcoding of crafted images. For the stable distribution (trixie), the fixed version is stated as 1.23.6-2~deb13u1. The advisory does not state CVE identifiers, CVSS scores, attack vector details beyond processing crafted images, or workarounds. Detection guidance is not stated, and the advisory refers readers to the Debian security tracker for detailed status. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00499.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6579-1 |
roundcube security update
Debian, RoundcubeDebian Linux, roundcube, Debian roundcube
|
Debian Security Advisories | |||
|
DSA-6579-1CVE-2026-113386CVE-2026-114714CVE-2026-114715CVE-2026-11471615 moreroundcube security update
Executive summaryDebian has released a security update for the roundcube webmail package, which fixes multiple vulnerabilities that could lead to information disclosure, cross-site scripting, or privilege escalation. The advisory does not state a severity rating for these issues. Debian recommends upgrading roundcube packages to the fixed version. Technical summaryThe advisory lists multiple vulnerabilities in roundcube, including IMAP command injection, cross-site scripting, SSRF bypass, email header injection, CSS property injection, remote content blocking bypass, information disclosure, and privilege escalation, spanning twenty CVE identifiers. Attack vector, required privileges, and user interaction are not stated. For Debian stable (trixie), the fixed version is 1.6.20+dfsg-0+deb13u1. No workarounds, detection guidance, or exploitation status are stated, and affected versions prior to the fix are not stated. The advisory points to the Debian security tracker for further status details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00495.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6580-1 |
erlang security update
Debian, erlangDebian Linux, erlang OTP, Debian erlang
|
Debian Security Advisories | |||
|
DSA-6580-1CVE-2026-55951CVE-2026-59696CVE-2026-65634CVE-2026-6635713 moreerlang security update
Executive summaryDebian has released a security update for the erlang package, which provides the Erlang/OTP programming language and runtime. The advisory covers 18 CVEs that could lead to denial of service, HTTP request smuggling, or bypass of authentication and access restrictions, including TLS server impersonation. Debian recommends upgrading the erlang packages to the fixed version for the stable distribution (trixie). Technical summaryThe advisory describes several vulnerabilities in Erlang/OTP affecting the HTTP client and server, SSH, TLS, ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing, and lists 18 CVE identifiers. The stated impacts are denial of service, HTTP request smuggling, and authentication or access restriction bypass, including TLS server impersonation. The vulnerability classes, attack vectors, and preconditions for each CVE are not stated. For the stable distribution (trixie), the fixed version is 1:27.3.4.1+dfsg-1+deb13u4. The update tightens protocol validation and HTTP/SSH resource limits, and applications relying on previously permissive behavior may need adjustment. No workarounds, detection guidance, or affected version ranges beyond the fixed version are stated, and CVSS scores are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00496.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6581-1 |
unbound security update
DebianDebian Linux, Debian unbound
|
Debian Security Advisories | |||
|
DSA-6581-1CVE-2026-109125CVE-2026-35501CVE-2026-50106CVE-2026-96405unbound security update
Executive summaryDebian has released a security update for the unbound DNS resolver package, which fixes five vulnerabilities. The advisory describes problems including DNSSEC trust bypasses, cache poisoning risk, and denial of service, and it recommends upgrading unbound packages. Technical summaryThe advisory covers five CVEs in Unbound: CVE-2026-35501 allows bypass of a configured island trust anchor underneath an insecure parent via an attacker-controlled NSEC record, and CVE-2026-50106 allows possible insecure NXDOMAIN responses for non-existing records under the same conditions. CVE-2026-96405 is a denial of service from aggregate DNS name chained pointer decompression work, and CVE-2026-97206 is a use-after-free on multi-threaded deployments triggered by DNS-over-QUIC path migration. CVE-2026-109125 is a possible cache poisoning issue via a cache side-channel exposed by 'unwanted-reply-threshold'. Fixed version for Debian trixie is 1.26.2-0+deb13u1. Attack vector details beyond those descriptions, CVSS scores, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: NLnet Labs Unbound Summarized from lists.debian.org/debian-security-announce/2026/msg00497.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6582-1 |
brotli security update
Debian, BrotliDebian Linux, Brotli, Debian brotli
|
Debian Security Advisories | |||
|
DSA-6582-1CVE-2026-111497brotli security update
Executive summaryDebian has released a security update for the brotli compression package, which is used in Debian's stable distribution (trixie). The advisory says the flaw could lead to denial of service or possibly arbitrary code execution, and Debian recommends upgrading brotli packages. Technical summaryThe advisory describes a vulnerability in Brotli, a general-purpose lossless compression suite, that could result in denial of service or potentially arbitrary code execution. It is tracked as CVE-2026-111497 with Debian bug 1151690. The vulnerability class, attack vector, and preconditions are not stated. For the stable distribution (trixie), the fixed version is 1.1.0-2+deb13u1. Workarounds are not stated, and no detection guidance is given beyond the recommendation to upgrade brotli packages and consult the Debian security tracker. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00498.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6534-3 |
webkit2gtk - regression update security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6534-3webkit2gtk - regression update security update
From the advisoryThe webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6577-1 |
chromium security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6577-1CVE-2026-110913CVE-2026-110914CVE-2026-110915CVE-2026-110916358 morechromium security update
From the advisorySecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6578-1 |
aide security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6578-1aide security update
From the advisoryTwo vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6573-1 |
firefox-esr security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6573-1CVE-2026-113470firefox-esr security update
From the advisoryThis update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6574-1 |
php8.4 security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6574-1CVE-2026-109618CVE-2026-109619php8.4 security update
From the advisoryIt was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6575-1 |
nginx security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6575-1CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97205nginx security update
From the advisorySeveral vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication. CVE-2026-15176 Mapping a rewritten request URI to a filesystem path in a location using the alias directive could cause a buffer overflow. CVE-2026-93479 Evaluation of string expressions in the HTTP and stream modules could overwrite reserved buffer space, resulting in a buffer overflow. Affected operations include evaluation of variable document roots and access log paths. The affected code was introduced into the trixie package by an earlier security backport. CVE-2026-95101 Incorrect handling of fragmented unknown HTTP/3 frames could cause their contents to be treated as request body data. When proxying requests, this could allow injection of requests into a backend server or bypass of request body size limits. CVE-2026-97205 A counter tracking pending asynchronous operations could overflow, causing request memory to be freed while still in use. This use-after-free could result in memory corruption or denial of service. CVE-2026-97629 Incomplete synchronisation of TLS session ticket keys between worker processes could leave a worker using uninitialised key material. This could allow forged TLS sessions and bypass of client certificate authentication. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6576-1 |
bind9 security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6576-1CVE-2026-19630CVE-2026-94300CVE-2026-96888CVE-2026-97313bind9 security update
From the advisorySeveral vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6572-1 |
ca-certificates security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6572-1ca-certificates security update
From the advisoryIt was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||