Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.

CVE Database V5

CVE-2026-114732: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.

CVE-2026-114731: CWE-770 Allocation of Resources Without Limits or Throttling in Roundcube Webmail

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

CVE-2026-114730: CWE-918 Server-Side Request Forgery (SSRF) in Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

CVE-2026-114729: CWE-184 Incomplete List of Disallowed Inputs in Roundcube Webmail

CVE-2026-114728 is a medium severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a remote content blocking bypass due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw allows remote content to be loaded from HTML messages without user consent. The issue was fixed by normalizing CSS escapes before matching and expanding attribute inspection.

Roundcube Webmail versions prior to 1.6.20 and 1.7.5 contain a vulnerability where the remote content blocking mechanism (rcube_washtml) fails to recognize certain CSS escape sequences in FuncIRI attributes such as url() tokens. The pattern used to detect these tokens enumerated only some escaped spellings, missing others like \000075rl( or u\72 l(. As a result, remote content could be loaded from HTML messages without user consent. The upstream fix involved resolving CSS escapes before pattern matching and extending inspection to the 'to', 'from', and 'by' attributes to prevent bypass.

CVE-2026-114728 is a medium severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a remote content blocking bypass due to incomplete handling of CSS escape sequences in FuncIRI attributes. This flaw allows remote content to be loaded from HTML messages without use

CVE-2026-114728: CWE-184 Incomplete List of Disallowed Inputs in Roundcube Webmail

A vulnerability in KubeVirt's migration proxy allows an attacker with a running pod on the cluster network to connect to an unauthenticated TCP listener that proxies directly to the virtqemud control socket of another tenant's virtual machine. This occurs when the disableTLS setting is enabled, removing mutual authentication and exposing the listener on all interfaces. The attacker can issue unfiltered libvirt RPC commands, potentially reading VM memory and configuration, modifying VM state, or destroying the VM. The vulnerability is rated high severity with a CVSS score of 8.5.

The vulnerability (CVE-2026-13325) exists in KubeVirt's migration proxy when spec.configuration.migrations.disableTLS is set to true. This configuration causes the target virt-handler to bind a plain TCP listener on all interfaces (0.0.0.0/::) on a random port without authentication, peer allow-list, or handshake token. This listener proxies directly into the virtqemud control socket of the target virt-launcher, allowing an attacker with a pod on the cluster network to issue unfiltered libvirt RPC commands against another tenant's VM. The attacker can read VM memory and configuration, modify VM state via QMP, or destroy the VM. The bind address is unconditionally 0.0.0.0, meaning the port remains reachable on the pod network even if a dedicated migration network is configured. The API documentation only mentions removal of live migration encryption but does not disclose the removal of mutual authentication. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 score is 8.5 (High), with attack vector Network, attack complexity High, privileges required Low, no user interaction, and scope changed. Impact includes high confidentiality, integrity, and availability impacts.

GCVE Database

Detailed information about A flaw was found in KubeVirt's migration proxy. (CVE-2026-13325). Get real-time updates, technical details, and mitigation strategies

CVE-2026-13325 has been rejected

Official rejection reason