Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...

CVE-2026-74997

Roundcube Webmail's markasjunk plugin cmd_learn driver allows RCE via crafted placeholder replacement values in versions before 1.6.18 and 1.7.x before 1.7.3. Fix: upgrade to 1.6.18 or 1.7.3. CVSS 8.8 (HIGH). Exploitation details not provided in documents.