Threat database

CVE-2026-114727 is a high-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. The issue involves unsafe handling of SVG and EPS image formats during contact photo uploads, where these formats are passed to ImageMagick for resizing. Since SVG and EPS can reference external resources and invoke ImageMagick delegates, this can lead to inclusion of functionality from an untrusted control sphere. The vulnerability is fixed by removing SVG and EPS from accepted image types.

Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability in the Bounce (resend) action. This occurs because the function rcube_mime::decode_address_list() did not remove control characters from the decoded display name, allowing CRLF sequences in the From display-name to inject arbitrary headers when a user bounces a message. This vulnerability has been fixed in versions 1.6.20 and 1.7.5.

Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5, contain a mail header injection vulnerability. This occurs because the function rcmail_sendmail only sanitized newline characters in the Subject and Organization headers, leaving other headers such as References, In-Reply-To, Message-ID, and From vulnerable to injection. A remote authenticated attacker could exploit this to inject arbitrary headers into outgoing emails. The issue was fixed by normalizing whitespace in all string header values in a later commit.

CVE-2026-114724 is a high-severity vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. It involves an object injection primitive caused by improper handling of session keys prefixed with “!” in the rcube_session::unserialize() function. This flaw allows an attacker who can influence stored session data to inject PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-114723 is a low-severity vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It allows bypassing of ImageMagick resource limits during thumbnail generation when the system falls back to using GD for image processing on non-Windows platforms. This can lead to server memory exhaustion due to lack of resource limits on crafted large images. The issue was fixed by applying memory checks uniformly across all platforms.

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

CVE-2026-114662 is a high-severity authentication bypass vulnerability in obot-platform's obot product before version 0.26.0. It allows unauthenticated attackers to steal API keys by exploiting the CLI login flow via a crafted token request. Attackers can create a token request, send the login link to a signed-in user, and then retrieve a non-expiring API key to take over the victim's account.

Grav versions from 2.0.0 up to but not including 2.2.5 contain an improper access control vulnerability in the FlexDirectory::dynamicFlexField() function. This flaw allows page authors to invoke arbitrary Flex object methods through flex-*@ directives in page frontmatter. When a user with page edit permissions opens such a page, certain directives like setStorageKey() and delete() execute in their session, potentially deleting protected pages that should not be deletable by either account.

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.

The Grav Login plugin versions from 3.6.0 up to but not including 3.9.13 contains a missing authorization vulnerability in the login.invite task. This flaw allows unauthenticated attackers to create invitation forms in page frontmatter that grant super user access. By submitting such a form, attackers can register an invited address with full site control, effectively escalating privileges to super user.

Grav versions from 2.0.0 up to but not including 2.2.5 contain an information disclosure vulnerability. This flaw allows page authors to capture visitors' HTTP Basic authentication credentials by embedding them in Twig page content. Specifically, authors can print the request URI object, which includes PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image, potentially exfiltrating administrator credentials to an external host.

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.

WWBN AVideo versions before 29.4.0 have an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers with such delegated privileges can submit requests to specific endpoints to delete or demote administrators and remove their videos or accounts.

CVE-2026-114722 is a vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5. It involves a CSS scoping bypass in HTML messages where certain CSS at-rules and selectors were not properly scoped to the message body. This flaw allows malicious HTML emails to restyle parts of the Roundcube interface outside the message area, enabling UI redressing and spoofing attacks.

CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue allows a remote authenticated attacker to bypass the disabled_actions configuration by using deprecated action aliases, enabling access to actions that should be disabled. The vulnerability was fixed by moving the check into the action handler and resolving aliases before comparison.

CVE-2026-114720 is a vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. It allows a remote authenticated attacker to inject CRLF sequences into the _flag parameter of the mail/mark action, enabling execution of arbitrary IMAP commands. The issue is due to improper neutralization of CRLF sequences (CWE-93).

A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.

CVE-2026-114719 is a Cross-Site Request Forgery (CSRF) vulnerability in Roundcube Webmail affecting versions 1.6.0 through before 1.6.20 and 1.7.0 through before 1.7.5. The issue occurs in the mark-as-junk action of the markasjunk plugin, where the _uid parameter is improperly handled, allowing the action to be executed without a valid CSRF token. This vulnerability has a low severity score and no known exploits in the wild.

CVE-2026-114718 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The issue arises in the password plugin where error messages from a password driver are displayed without proper HTML escaping, allowing script injection if the backend can influence the error text. This vulnerability was fixed by escaping the driver message before display.

A missing authorization vulnerability in the Drupal Advanced Search module allows forceful browsing. This issue affects versions from 0.0.0 up to 2.4.5. The vulnerability has a medium severity rating with a CVSS score of 4.2, indicating limited impact on confidentiality and integrity with no impact on availability. No patch or remediation information is currently provided.