DEBIAN-CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

DEBIAN-CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 id: CVE-2013-5528 info: name:...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

CVE-2026-114716

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability. The root cause lies in the rcmail_sendmail::extract_inline_images() function, which fails to validate the media type retrieved from inline image data URIs. A remote authenticat...

PT-2026-120953

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled actions by requesting it through its deprecate...

CVE-2026-114135

A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated user with restricted privileges can exploit this flaw to open...

CVE-2026-114477

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114475

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

CVE-2026-114477

Progressive Robot hMailServer versions 6.2.25 through 6.3.6 are affected by a Missing Authorization vulnerability in the REST metrics route. The GET /api/v1/metrics/history endpoint fails to restrict access for credentials confined to specific named domains, allowing these users to view server-wi...

CVE-2026-114477 Missing Authorization in hMailServer

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

EUVD-2026-107320

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114475 Missing Authorization in hMailServer

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

CVE-2026-114475

Progressive Robot hMailServer versions 6.3.4 through 6.3.6 are vulnerable to missing authorization in the REST role-management routes. The root cause is an authorization gate failure that allows a remote authenticated user with a credential confined to specific named domains to access routes requ...

EUVD-2026-107318

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

Security Bulletin: Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-81209)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-81209 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to...

EUVD-2026-106862

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

PT-2026-120655

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...