Live Threat Intelligence Radar

CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions 1.6.0 through before 1.6.20 and 1.7.0 through before 1.7.5. The flaw occurs in multi-host installations where logging in with an alias address could authenticate a user to a different IMAP host's account due to improper qualification of the alias lookup by IMAP host. This issue was fixed upstream by qualifying alias logins by IMAP host.

Roundcube Webmail versions before 1.6.20 and 1.7.5 are vulnerable to an uncontrolled resource consumption issue in the CSS proxy feature. This vulnerability allows an attacker to cause excessive memory usage by referencing a stylesheet URL from an attacker-controlled host, which is read into memory without size limits or timeouts. The issue was fixed by adding a 5 MB size limit, streaming reads, and applying a read timeout to the CSS proxy content processing.

Roundcube Webmail versions 1.6.14 through 1.6.19 and 1.7.0 through 1.7.4 contain a server-side request forgery (SSRF) vulnerability due to an incomplete network blocklist in the is_local_url() filter. This allowed bypass via certain NAT64 prefixes and the unspecified address, enabling crafted URLs to access internal loopback, link-local, and cloud metadata addresses. The issue was fixed upstream by updating the filter to include these missing address ranges.

CVE-2026-114729 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 that allows remote content blocking to be bypassed. The issue arises because the remote content blocker did not inspect the SVG SMIL animation attribute 'by', allowing remote content to load without user consent. This can disclose the client IP address and confirm that a message was opened. The vendor has fixed this issue in a commit addressing the bypass via the 'by' attribute.

CVE-2026-114728 is a medium severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a remote content blocking bypass due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw allows remote content to be loaded from HTML messages without user consent. The issue was fixed by normalizing CSS escapes before matching and expanding attribute inspection.

CVE-2026-114577 is a medium severity SQL injection vulnerability in the oretnom23 php-travel-agency-system. It affects the admin/insert.php file's Insertion Handler component, where manipulation of several parameters can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although the issue was reported early, the project has not yet responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.

This entry is a daily security news update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Thursday, October 22nd, 2026'. It provides general situational awareness and threat level information but does not contain specific details about a security vulnerability or threat.

CVE-2026-114727 is a high-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. The issue involves unsafe handling of SVG and EPS image formats during contact photo uploads, where these formats are passed to ImageMagick for resizing. Since SVG and EPS can reference external resources and invoke ImageMagick delegates, this can lead to inclusion of functionality from an untrusted control sphere. The vulnerability is fixed by removing SVG and EPS from accepted image types.

Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability in the Bounce (resend) action. This occurs because the function rcube_mime::decode_address_list() did not remove control characters from the decoded display name, allowing CRLF sequences in the From display-name to inject arbitrary headers when a user bounces a message. This vulnerability has been fixed in versions 1.6.20 and 1.7.5.

Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability. This occurs because the function rcmail_sendmail only sanitized newline characters in the Subject and Organization headers, leaving other headers such as References, In-Reply-To, Message-ID, and From vulnerable to injection. A remote authenticated attacker could exploit this to inject arbitrary headers into outgoing emails. The issue was fixed by normalizing whitespace in all string header values in a later commit.