2398 matches found
CVE-2026-9818 Roundcube Local/Private URL Fetch Bypass
Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services...
CVE-2026-9818
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-9818
CVE-2026-9818 is rejected/not used; this entry does not represent an active vulnerability.
The vulnerability of the RoundCube Webmail email client, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code.
The vulnerability of the RoundCube Webmail client is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created SVG document...
PT-2026-44369
Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services...
Debian dla-4604 : roundcube - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4604 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4604-1 [email protected]...
The vulnerability of the LDAP protocol implementation in the RoundCube Webmail client allows a hacker to execute arbitrary code.
The vulnerability of the RoundCube Webmail client LDAP implementation is related to the improper handling of control flows. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the RoundCube Webmail email client lies in the lack of validation for incoming requests, allowing attackers to delete any files they desire.
The vulnerability of the RoundCube Webmail email client is related to the lack of validation for incoming requests. Exploiting this vulnerability could allow a malicious actor to delete any files at will...
The vulnerability of the RoundCube Webmail email client lies in the lack of validation for incoming requests, which allows attackers to disclose protected information or bypass existing security mechanisms.
The vulnerability of the RoundCube Webmail email client is related to the lack of validation during the processing of incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information or bypass existing security mechanisms...
The vulnerability of the RoundCube Webmail email client lies in the lack of validation for incoming requests, which allows attackers to disclose protected information or enhance their privileges.
The vulnerability of the RoundCube Webmail email client is related to the lack of validation for incoming requests. Exploiting this vulnerability can allow an attacker to disclose protected information or enhance their privileges...
The vulnerability of the preg_replace() function in the RoundCube Webmail email client allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the pregreplace function in the RoundCube Webmail email client is related to the lack of security measures for handling SQL query structures. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...
The vulnerability of the RoundCube Webmail client, related to the lack of protective measures for the website structure, allows attackers to execute SSRF attacks and disclose the protected information.
The vulnerability of the RoundCube Webmail email client is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack and disclose sensitive information...
Debian dsa-6301 : roundcube - security update
The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6301 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected]...
[SECURITY] [DSA 6301-1] roundcube security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 27, 2026 https://www.debian.org/security/faq -...
SUSE CVE-2026-35540
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts...
SUSE CVE-2026-48842
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...
SUSE CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix fo...
SUSE CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. Support for code evaluation has been removed in 1.6.16 and 1.7.1...