A vulnerability in Roundcube was fixed that addressed a bug where an alias login was not properly qualified by the IMAP host. This flaw could allow an attacker with low privileges to gain unauthorized access under certain conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 6.8, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact.
A vulnerability in Roundcube involves the CSS proxy content processing lacking a size limit, potentially leading to denial of service conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A Server-Side Request Forgery (SSRF) vulnerability in Roundcube allows bypass of the is_local_url() filter via NAT64 64:ff9b::/96 addresses. This vulnerability affects multiple specific versions of Roundcube and has a high severity rating with a CVSS score of 7.2. The flaw could allow an attacker to cause the server to make unauthorized requests, potentially leading to information disclosure or other impacts.
A vulnerability in Roundcube allows bypassing remote content blocking via SVG SMIL by attribute. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality without affecting integrity or availability.
HAProxy versions before 3.4.6 contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service. This vulnerability does not impact confidentiality or integrity but can disrupt availability by causing service outages.
HAProxy versions 3.2 before 3.4.6 contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service (DoS) condition. This flaw does not impact confidentiality or integrity but can disrupt availability by crashing or otherwise incapacitating the service.
A vulnerability in Roundcube allows bypassing remote content blocking via CSS escapes in FuncIRI attributes. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require user interaction or privileges and impacts confidentiality by potentially allowing remote content to be loaded despite blocking mechanisms.
A high-severity vulnerability (CVE-2026-114727) in Roundcube involves unsafe handling of attachment content passed to ImageMagick during image resizing. This flaw could lead to high impact on confidentiality, integrity, and availability. Multiple specific versions of Roundcube are affected. The vulnerability has a CVSS score of 8.3, indicating a serious risk. No public exploits are known in the wild. The product is not a cloud service, and no explicit patch information is provided in the input.
A mail header injection vulnerability exists in Roundcube via the From display-name in the Bounce (resend) action. This flaw allows an attacker to inject malicious content into email headers when resending bounced emails. The vulnerability affects multiple specific versions of Roundcube. The CVSS score is 5.8, indicating a medium severity impact primarily on email integrity.
A mail header injection vulnerability exists in Roundcube affecting specific versions. The flaw involves injection via the References, In-Reply-To, Message-ID, and From email header parameters. This vulnerability has a medium severity rating with a CVSS score of 5.0. No known exploits in the wild have been reported. The affected versions are explicitly listed and include multiple specific package versions.
A high-severity vulnerability (CVE-2026-114724) in Roundcube affects multiple specific versions. The flaw involves an object injection primitive in the rcube_session::unserialize() function via session keys prefixed with an exclamation mark (!). This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.4, indicating high impact. No public exploits or known exploitation in the wild have been reported. The affected versions are explicitly listed, and the product is not a cloud service.
A vulnerability in ImageMagick allows resource limits to be bypassed via the GD fallback mechanism during thumbnail generation. This flaw affects specific Ubuntu package versions of ImageMagick 6.7.7.10. The issue has a low severity with a CVSS score of 3.7, indicating limited impact primarily on availability. No known exploits are reported in the wild.
A medium severity vulnerability (CVE-2026-114722) in Roundcube allows a CSS scoping bypass in HTML messages using at-rules. This flaw could enable limited unauthorized information disclosure or modification via crafted HTML content. The issue affects multiple specific Roundcube versions. No known exploits are reported in the wild.
A vulnerability in Roundcube allows deprecated action aliases to bypass the disabled_actions setting. This issue could lead to limited unauthorized actions due to improper enforcement of disabled actions.
A high-severity vulnerability (CVE-2026-114720) in Roundcube allows IMAP command injection via CRLF characters in the _flag parameter of the mail/mark action. This flaw can lead to unauthorized modification of mail flags, impacting the integrity of mail data. The vulnerability affects multiple specific versions of Roundcube as listed. The CVSS score is 7.1, indicating a high impact on confidentiality and integrity but no impact on availability.
A Cross-Site Request Forgery (CSRF) validation bypass vulnerability exists in the mark-as-junk action of Roundcube. This flaw allows an attacker to perform unauthorized mark-as-junk actions without proper CSRF validation. The vulnerability has a low severity score and affects multiple specific versions of Roundcube.
A cross-site scripting (XSS) vulnerability exists in Roundcube due to improper handling of password driver error responses. This issue can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability affects multiple specific versions of Roundcube. The CVSS score is 4.7, indicating a medium severity level.
A mail header injection vulnerability exists in Roundcube when forwarding a message as an attachment, specifically via the subject field. This flaw allows an attacker to inject malicious content into mail headers. The vulnerability has a medium severity rating with a CVSS score of 4.0. Multiple specific versions of Roundcube are affected. No public exploits or known active exploitation have been reported. The vulnerability has been publicly disclosed as of October 23, 2026.
A high-severity vulnerability (CVE-2026-114716) in Roundcube allows mail header injection via the media type in an inline image data URI. This flaw affects multiple specific versions of Roundcube and can lead to partial confidentiality loss and high integrity impact without availability impact. The vulnerability was published on October 23, 2026, and has a CVSS score of 8.5.
A vulnerability in Roundcube's Password Modoboa driver allows an attacker with limited privileges to change the password of another account. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 6.8. The vulnerability does not have known exploits in the wild and is not a cloud service.