Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.3 | CVE-2026-114731 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain an uncontrolled resource consumption flaw in the CSS proxy (the utils/modcss action). The advisory does not state a severity rating for this specific CVE, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5, which the advisory indicates are the fixed releases. Technical summaryThe flaw is classed as uncontrolled resource consumption in the CSS proxy utils/modcss action of Roundcube Webmail. The advisory states the fix is a size limit added to the CSS proxy content processing, in upstream 1.6.20 and 1.7.5. Attack vector and preconditions are not stated in this advisory. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. Debian package versions referenced include roundcube/1.6.19+dfsg-1, roundcube/1.6.19+dfsg-0+deb13u1 and roundcube/1.6.5+dfsg-1+deb12u12 as found versions, with roundcube/1.6.20+dfsg-1 as the fixed Debian version. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-114730 |
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
Executive summaryRoundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 are affected by a server-side request forgery filter bypass, and the advisory is tied to a larger batch of fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this CVE. The fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later, as the upstream and Debian updates indicate. Technical summaryThe flaw is a server-side request forgery (SSRF) filter bypass in the is_local_url() check, which the advisory says can be bypassed via the NAT64 64:ff9b::/96 prefix. The advisory does not state the attack vector details, required privileges, or user interaction beyond this description. Affected versions are stated as 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 as written. Debian's bug report lists found versions 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1, and fixed version 1.6.20+dfsg-1. No CVSS score, workaround, or exploitation status is stated, and no detection guidance is given for this specific CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114729 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a remote content blocking bypass, as well as a set of other security fixes released together in the same update. The advisory does not state a severity rating for this specific CVE, and the Debian bug report lists the overall batch as important. The recommended action is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in Roundcube, reported as a bypass via SVG SMIL by attribute, which lets remote content get past the blocker in HTML messages. The advisory does not describe the attack vector in detail beyond this, and preconditions are not stated. Fixed versions are given as 1.6.20 and, per the title, 1.7.5 for the 1.7.x branch; the Debian package fix is 1.6.20+dfsg-1. Affected Debian versions listed are 1.6.5+dfsg-1+deb12u12, 1.6.19+dfsg-1 and 1.6.19+dfsg-0+deb13u1. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114728 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that lets remote content bypass blocking, which is a privacy concern for webmail users. The advisory does not state a severity score, and the Debian bug report lists its severity as important. The vendor's fix is to upgrade to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a remote content blocking bypass in the handling of FuncIRI attributes, caused by CSS escapes, and the advisory describes it as a repeat fix. The advisory does not state the attack vector details, required user interaction, or privileges. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and fixed versions are 1.6.20 and 1.7.5. Debian's package versions listed were 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1, and 1.6.5+dfsg-1+deb12u12, with fix 1.6.20+dfsg-1. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-114727 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Debian, ImageMagick, RoundcubeImageMagick, Roundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw where potentially unsafe attachment content is passed into ImageMagick when images are resized. The advisory does not state a severity rating for this specific issue, but the Debian bug report that tracks the batch of fixes is marked important. The fix is to update Roundcube to 1.6.20 or 1.7.5 or later, as the upstream release notes recommend. Technical summaryThe flaw is described as passing potentially unsafe content into ImageMagick during image resizing, which is an unsafe handling of attachment data. The advisory does not state the attack vector, required privileges or user interaction, or a CVSS score. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5, and the fixed versions are 1.6.20 and 1.7.5 per the advisory text. Debian's tracker lists fixed package version 1.6.20+dfsg-1 and found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L AffectsDebianImageMagickRoundcubeImageMagickRoundcube WebmailDebian roundcube
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.8 | CVE-2026-114726 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a mail header injection flaw in the Bounce (resend) action, which is one of a batch of security fixes released together. The advisory does not state a severity score for this specific CVE, though the Debian bug report is marked important. The recommended remedy is to update to Roundcube 1.6.20 or 1.7.5 or later. Technical summaryThe flaw is a mail header injection in the Bounce (resend) action of Roundcube Webmail, fixed via a change to the From display-name handling. The advisory names affected versions as before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. Attack vector, required privileges, and user interaction are not stated. No workaround is stated, and no CVSS score or exploitation status is stated. Detection guidance is not stated. The advisory notes that the CVE ID for this issue is CVE-2026-114726, assigned as the Bounce action header injection item in a batch fix list. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.4 | CVE-2026-114724 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()
Executive summaryThis advisory concerns Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5, where an object injection flaw in session handling is described. The advisory does not state a severity rating for this specific CVE, but the Debian bug report lists the related batch as important, and the fix is to upgrade to Roundcube 1.6.20 or 1.7.5. Technical summaryThe flaw is an object injection primitive in rcube_session::unserialize(), triggered by session keys with a "!" prefix, per the advisory text. The advisory does not state the attack vector, required privileges, or exploitation status. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1 with found versions 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12. The advisory does not state a CVSS score, a workaround, or detection guidance for this issue. The Debian report says the fix is in the upstream 1.6.20 release, and the upgrade is the recommended remediation. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-114722 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a CSS scoping bypass in HTML messages, which the advisory describes as part of a larger batch of security fixes in the 1.6.20 and 1.7.5 releases. The advisory does not state a severity rating for this specific flaw, and the upstream fix is to update to the patched release. Technical summaryThe flaw is a CSS scoping bypass in how HTML messages are rendered, fixed by a commit described as using at-rules. The advisory does not state the attack vector, required user interaction, or privileges. Affected versions are stated as Roundcube before 1.6.20 and 1.7.x before 1.7.5, and the Debian tracker lists fixed version roundcube/1.6.20+dfsg-1. A workaround is not stated, and no CVSS score or exploitation status is given. Detection guidance is not stated. The Debian report lists this CVE among a batch of related fixes in the same release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 3.1 | CVE-2026-114721 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114721Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a flaw that allows the disabled_actions configuration setting to be bypassed. The advisory does not state a severity rating for this specific issue, though the Debian bug report that tracks the batch of fixes is marked important. The fix is to update to Roundcube 1.6.20 or 1.7.5, as the advisory and linked release notes indicate. Technical summaryThe flaw is a bypass of the disabled_actions configuration setting, which the advisory attributes to deprecated action aliases that were not checked against the setting. The advisory does not state the attack vector, required privileges, or user interaction needed. Affected versions are stated as Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5, and the Debian report lists found versions roundcube/1.6.5+dfsg-1+deb12u12, roundcube/1.6.19+dfsg-1, and roundcube/1.6.19+dfsg-0+deb13u1, with fixed version roundcube/1.6.20+dfsg-1. No workaround, CVSS score, detection guidance, or exploitation status is stated for this issue. The same batch of upstream fixes includes many other flaws, but this advisory concerns only the disabled_actions bypass. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-114720 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114720Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
Executive summaryRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a set of security flaws, including an IMAP command injection issue, that the advisory describes as a batch of multiple vulnerabilities. The advisory does not state a severity score for the issue, and the Debian bug report that it draws on rates the batch as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, or to the fixed Debian package 1.6.20+dfsg-1. Technical summaryThe advisory's headline describes an IMAP command injection caused by CRLF characters in parameters, which the Debian report ties to the _uid parameter of mail/headers and mail/viewsource and to the _flag parameter of the mail/mark action. The Debian report lists many other fixes, including SSRF filter bypass, remote content blocking bypass, mail header injection, XSS, CSRF bypass, and object injection in rcube_session::unserialize(), and it associates CVE IDs from CVE-2026-114714 through CVE-2026-114732 and CVE-2026-113386 with these items. Affected versions are stated as roundcube 1.6.19+dfsg-1, 1.6.19+dfsg-0+deb13u1 and 1.6.5+dfsg-1+deb12u12, and the fixed version is stated as 1.6.20+dfsg-1; the upstream fix version for the 1.7.x branch is stated only as 1.7.5 in the Debian report's reference to upstream release notes. Attack preconditions, authentication requirements, CVSS scores, exploitation status, and detection guidance are not stated. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.7 | CVE-2026-114718 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114718Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a cross-site scripting flaw in the password plugin. The advisory is part of a larger batch of Roundcube security fixes described in a Debian bug report, and the fixes are shipped in upstream release 1.6.20 and 1.7.5. The advisory does not state a severity score for this specific CVE. Technical summaryThe flaw is a cross-site scripting (XSS) issue in handling of password driver error responses in the Roundcube password plugin, per the upstream fix list quoted in the Debian bug report. The advisory does not state the attack vector or user interaction required, nor a CVSS score. Fixed versions are stated as Roundcube 1.6.20 (Debian package roundcube/1.6.20+dfsg-1) and 1.7.5 for the 1.7.x branch. Affected versions are stated as before 1.6.20 and 1.7.x before 1.7.5. The advisory does not state any workaround or detection guidance for this issue. The Debian report lists the same fix as part of a batch of many other issues, and the CVE mapping in the report links this XSS fix to CVE-2026-114718. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.5 | CVE-2026-114716 |
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Debian, RoundcubeRoundcube Webmail, Debian roundcube
|
NVD | |||
|
CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
Executive summaryThe advisory says Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are affected by a mail header injection vulnerability, and it is part of a larger batch of security fixes in the Debian bug report. The advisory does not state a severity score for this CVE, and it describes the Debian bug as important. The fix is to update to Roundcube 1.6.20 or 1.7.5, and Debian has shipped roundcube 1.6.20+dfsg-1 for this batch. Technical summaryThe CVE entry describes a mail header injection flaw in Roundcube Webmail. The Debian bug report lists the CVE-2026-114716 mapping to a fix titled 'mail header injection via media type in an inline image data URI', which is one of 19 fixes in the 1.6.20 release, and the report links the CVE to that commit. Versions before 1.6.20 and 1.7.x before 1.7.5 are stated as affected, and the fixed versions are 1.6.20 and 1.7.5, with Debian's fixed package named roundcube/1.6.20+dfsg-1. The advisory does not state the attack vector, required privileges, or user interaction needed. It does not state a CVSS score, workarounds, or detection guidance, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from bugs.debian.org/1151279 Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6579-1 |
roundcube security update
Debian, RoundcubeDebian Linux, roundcube, Debian roundcube
|
Debian Security Advisories | |||
|
DSA-6579-1CVE-2026-113386CVE-2026-114714CVE-2026-114715CVE-2026-11471615 moreroundcube security update
Executive summaryDebian has released a security update for the roundcube webmail package, which fixes multiple vulnerabilities that could lead to information disclosure, cross-site scripting, or privilege escalation. The advisory does not state a severity rating for these issues. Debian recommends upgrading roundcube packages to the fixed version. Technical summaryThe advisory lists multiple vulnerabilities in roundcube, including IMAP command injection, cross-site scripting, SSRF bypass, email header injection, CSS property injection, remote content blocking bypass, information disclosure, and privilege escalation, spanning twenty CVE identifiers. Attack vector, required privileges, and user interaction are not stated. For Debian stable (trixie), the fixed version is 1.6.20+dfsg-0+deb13u1. No workarounds, detection guidance, or exploitation status are stated, and affected versions prior to the fix are not stated. The advisory points to the Debian security tracker for further status details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00495.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||