EUVD-2026-126082

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to que...

CVE-2026-129485

Kroki versions prior to 0.36.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the BlockDiag engine family. Unauthenticated attackers can exploit node icon and background attributes by sending crafted diagrams to the POST /blockdiag/svg endpoint or related sibling endp...

Roundcube Webmail security vulnerability

Roundcube Webmail is an open-source browser-based IMAP client developed by Roundcube. It supports address book management, information search, spelling checking, and more. Versions of Roundcube Webmail prior to 1.5.14 and 1.6.14 contained security vulnerabilities. These vulnerabilities stemmed fr...