CVE-2026-75010 is a vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3. It affects instances using the password plugin with the modoboa driver, where a crafted session can leak a Modoboa API authentication token to a user-controlled host. This could lead to limited confidentiality and integrity impacts but does not affect availability.
CVE-2026-75003 affects Roundcube Webmail versions prior to 1.6.18 and 1.7.3. The vulnerability involves an unclosed url() in a FuncIRI attribute within an SVG image, which can bypass remote image blocking. This flaw may allow information disclosure or privilege escalation. The issue is fixed in versions 1.6.18 and 1.7.3.
CVE-2026-75000 is a vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.3 where improper sanitization of the SVG animate "by" attribute allows remote image blocking bypass. This flaw can lead to information disclosure or privilege escalation. The issue is fixed in versions 1.6.18 and 1.7.3.
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.
This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.
CVE-2026-48847 is a vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 that allows an unauthenticated attacker to delete arbitrary files by exploiting session poisoning via redis or memcache. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between spheres. The CVSS score is 3.7, reflecting a low severity impact primarily affecting availability with no confidentiality or integrity impact.
CVE-2026-48846 is a medium severity vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0. It allows bypassing the remote image blocking feature via a crafted CSS var() value in an email message. This bypass may lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet.
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.
Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
A vulnerability in OpenStack Nova allows an authenticated user to overwrite arbitrary files on the compute host due to unconstrained handling of disk image formats by the qemu-img utility. This can lead to data destruction or denial of service during instance operations such as resizing. The issue affects certain versions of Red Hat OpenStack Services on OpenShift. No effective mitigation is currently available that meets Red Hat's criteria for ease of use and stability.
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system.
Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account.
The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)