A high-severity vulnerability (CVE-2026-114724) in Roundcube affects multiple specific versions. The flaw involves an object injection primitive in the rcube_session::unserialize() function via session keys prefixed with an exclamation mark (!). This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 7.4, indicating high impact. No public exploits or known exploitation in the wild have been reported. The affected versions are explicitly listed, and the product is not a cloud service.
A vulnerability in ImageMagick allows resource limits to be bypassed via the GD fallback mechanism during thumbnail generation. This flaw affects specific Ubuntu package versions of ImageMagick 6.7.7.10. The issue has a low severity with a CVSS score of 3.7, indicating limited impact primarily on availability. No known exploits are reported in the wild.
CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in multi-host setups where logging in with an alias address could incorrectly authenticate a user to an account on a different IMAP host due to improper qualification of the alias lookup. This issue was fixed by qualifying alias logins by IMAP host in the code.
A mail header injection vulnerability exists in Roundcube when forwarding a message as an attachment, specifically via the subject field. This flaw allows an attacker to inject malicious content into mail headers. The vulnerability has a medium severity rating with a CVSS score of 4.0. Multiple specific versions of Roundcube are affected. No public exploits or known active exploitation have been reported. The vulnerability has been publicly disclosed as of October 23, 2026.
A high-severity vulnerability (CVE-2026-114716) in Roundcube allows mail header injection via the media type in an inline image data URI. This flaw affects multiple specific versions of Roundcube and can lead to partial confidentiality loss and high integrity impact without availability impact. The vulnerability was published on October 23, 2026, and has a CVSS score of 8.5.
CVE-2026-114730 is a server-side request forgery (SSRF) vulnerability in Roundcube Webmail versions 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5. The vulnerability arises because the network blocklist used by the is_local_url() function did not include certain NAT64 prefixes and the unspecified address, allowing crafted URLs to bypass the filter and access internal network addresses. This flaw was fixed in versions 1.6.20 and 1.7.5.
CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue arises because the disabled_actions configuration setting could be bypassed by using deprecated action aliases, allowing a remote authenticated attacker to access actions that should be disabled. This flaw was fixed by moving the check into the action handler and resolving aliases before comparison.
A missing authorization vulnerability in the Drupal Advanced Search module allows forceful browsing. This issue affects versions from 0.0.0 up to 2.4.5. The vulnerability has a medium severity rating with a CVSS score of 4.2, indicating limited impact on confidentiality and integrity with no impact on availability. No patch or remediation information is currently provided.
CVE-2026-84917 is an incorrect authorization vulnerability in the Drupal Jsonapi Role Access module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.0.2. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.0.2.
CVE-2026-81163 is a path traversal vulnerability in the Drupal Media Library Importer module that allows improper limitation of pathnames to restricted directories. This flaw affects versions from 0.0.0 up to but not including 2.1.6. The vulnerability could allow an attacker with limited privileges to read or write files outside the intended directory. The issue has been fixed in version 2.1.6. The CVSS score is 5.4, indicating a medium severity level.
CVE-2026-84919 is a stored cross-site scripting (XSS) vulnerability in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery. It affects versions from 0.0.0 up to but not including 5.0.9. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in version 5.0.9. The CVSS v3.1 base score is 4.6, indicating a medium severity level.
CVE-2026-84920 is an incorrect authorization vulnerability in the Drupal Unpublished Node Permissions module that allows forceful browsing of unpublished content. Versions from 0.0.0 up to but not including 1.8.0 are affected. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.8.0.
CVE-2026-87936 is an SQL Injection vulnerability in the Drupal amazee.ai Private AI Provider. It affects versions from 0.0.0 up to but not including 1.3.7, and from 1.4.0 up to but not including 1.4.3. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access. The issue is fixed in versions 1.3.7 and 1.4.3. The CVSS score is 6.5, indicating a medium severity risk.
CVE-2026-87937 is an Open Redirect vulnerability in the Drupal Central Authentication System (CAS) Server. It affects versions from 0.0.0 up to but not including 2.0.4, and from 2.1.0 up to but not including 2.1.3. This flaw allows attackers to redirect users to untrusted sites, potentially enabling phishing or other malicious activities. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are 2.0.4 and 2.1.3.
CVE-2026-87945 is an Open Redirect vulnerability (CWE-601) in the Drupal SAML SSO - Service Provider module affecting versions from 0.0.0 up to but not including 3.2.0. This flaw allows attackers to redirect users to untrusted external sites by manipulating URLs. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 3.2.0.
CVE-2026-96370 is an incorrect authorization vulnerability in the Drupal Webform module that allows Server Side Request Forgery (SSRF). It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.4. Fixed versions 6.2.12 and 6.3.1 address this issue.
CVE-2026-96366 is an Incorrect Authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with low complexity and no privileges required for exploitation.
An Improper Control of Interaction Frequency vulnerability (CWE-799) exists in Drupal Webform, allowing functionality misuse. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.
CVE-2026-96356 is an Incorrect Authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1. The vulnerability has a CVSS score of 5.3, indicating medium severity, and does not require user interaction or privileges to exploit.