{"kind": "product", "path": "vulns/debian-13/roundcube", "name": "roundcube", "product": "roundcube", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-114732", "noindex": false, "published": "2026-10-22T02:16:51.833Z", "modified": "2026-10-22T02:16:51.833Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114732", "title": "CVE-2026-114732", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114731", "noindex": false, "published": "2026-10-22T02:12:34.577Z", "modified": "2026-10-22T02:12:34.577Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00431, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114731", "title": "CVE-2026-114731", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114730", "noindex": false, "published": "2026-10-22T02:09:40.059Z", "modified": "2026-10-22T02:09:40.059Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.00312, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114730", "title": "CVE-2026-114730", "description": "Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/6e1d480e730a45f29829b6a11af608d5d6eb3db6", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114729", "noindex": false, "published": "2026-10-22T02:05:39.669Z", "modified": "2026-10-22T02:05:39.669Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00375, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114729", "title": "CVE-2026-114729", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/96d993b4ac57166a094b5774f4761e0b905d9a05", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114728", "noindex": false, "published": "2026-10-22T02:02:49.325Z", "modified": "2026-10-22T02:02:49.325Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00379, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114728", "title": "CVE-2026-114728", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \\000075rl( or u\\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/2f74267f0e13bed7182b1d2294cc4f3c5c46dcee", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114727", "noindex": false, "published": "2026-10-22T01:59:00.789Z", "modified": "2026-10-22T01:59:00.789Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114727", "title": "CVE-2026-114727", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114726", "noindex": false, "published": "2026-10-22T01:55:25.693Z", "modified": "2026-10-22T01:55:25.693Z", "cvss": 5.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114726", "title": "CVE-2026-114726", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114725", "noindex": false, "published": "2026-10-22T01:52:10.894Z", "modified": "2026-10-22T01:52:10.894Z", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "severity": "medium", "epss": 0.00286, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114725", "title": "CVE-2026-114725", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/acd32a86f631dd6dcda8ac3ec7bd9ba4d4c0c117", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114724", "noindex": false, "published": "2026-10-22T01:48:23.338Z", "modified": "2026-10-22T01:48:23.338Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114724", "title": "CVE-2026-114724", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/93284f3f0e13f99af37fc3b81861e142eea8a922", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114723", "noindex": false, "published": "2026-10-22T01:44:01.558Z", "modified": "2026-10-22T01:44:01.558Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00332, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114723", "title": "CVE-2026-114723", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114722", "noindex": false, "published": "2026-10-22T01:39:43.658Z", "modified": "2026-10-22T01:39:43.658Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114722", "title": "CVE-2026-114722", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Upstream fixed this in the commit “Fix CSS scoping bypass in HTML messages using at-rules”.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/95b81ae12e2819a9b7e8636b5859b6244cda383e", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114721", "noindex": false, "published": "2026-10-22T01:36:10.621Z", "modified": "2026-10-22T01:36:10.621Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00296, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114721", "title": "CVE-2026-114721", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstream fixed this in the commit “Fix bug where deprecated action aliases bypassed `disabled_actions` setting”, which moves the check into rcmail::action_handler() and resolves aliases before comparing.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/cd413140bf5362cd86a4327dd6364387505865a9", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114720", "noindex": false, "published": "2026-10-22T01:32:44.426Z", "modified": "2026-10-22T01:32:44.426Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00805, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114720", "title": "CVE-2026-114720", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/6c3c1897c11e193e47fccaabc87e9ca2a0a73e51", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114719", "noindex": false, "published": "2026-10-22T01:28:45.516Z", "modified": "2026-10-22T01:28:45.516Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00246, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114719", "title": "CVE-2026-114719", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/6ea2bbe356099c9da98eabcfeafd8d6aa2d67b3d", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114718", "noindex": false, "published": "2026-10-22T01:24:46.941Z", "modified": "2026-10-22T01:24:46.941Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00241, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114718", "title": "CVE-2026-114718", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114717", "noindex": false, "published": "2026-10-22T01:21:14.794Z", "modified": "2026-10-22T01:21:14.794Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "severity": "medium", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114717", "title": "CVE-2026-114717", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/4c3291ce9df9e1d3b45330d0854d65cd8efbeee9", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114716", "noindex": false, "published": "2026-10-22T01:17:45.277Z", "modified": "2026-10-22T01:17:45.277Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "severity": "high", "epss": 0.0039, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114716", "title": "CVE-2026-114716", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047fe8e3cba81db2023cdfc", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114715", "noindex": false, "published": "2026-10-22T01:13:35.419Z", "modified": "2026-10-22T01:13:35.419Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00341, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114715", "title": "CVE-2026-114715", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a password change could be applied to a different account. Upstream fixed this in the commit “Fix bug where Password Modoboa driver could change password for another account”, which selects the account whose username matches and fails if none does.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/e6a77272a5837e7104238a2f270ac412ff0a8ff3", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-114714", "noindex": false, "published": "2026-10-22T01:08:34.579Z", "modified": "2026-10-22T01:08:34.579Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-114714", "title": "CVE-2026-114714", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/dbdfcac498164bcacb7ce273b6341678dd70c166", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-113386", "noindex": false, "published": "2026-10-20T04:53:46.220Z", "modified": "2026-10-22T21:17:14.176Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00972, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-113386", "title": "CVE-2026-113386", "description": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.", "references": ["https://bugs.debian.org/1151279", "https://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a", "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "fixes": ["1.6.20+dfsg-0+deb13u1"], "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}]}], "total": 125, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "roundcube", "path": "vulns/debian-13/roundcube", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 20, "kev": 0}, "lastmod": "2026-10-22T21:17:14.176Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}