CVE-2026-49049

CVE-2026-49049 — Helix3 Joomla Plugin JoomShaper Unauthenticated AJAX Handler — Read-Only Vulnerability Scanner Overview CVE-2026-49049 affects the Helix3 template framework for Joomla versions 1.0 through 3.1.0. The onAjaxHelix3 handler, reachable via Joomla's comajax dispatcher, performs no...

Intel Neural Compressor <2.5.0 - SQL Injection

Improper input validation in some IntelR Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access. id: CVE-2024-22476 info: name: Intel Neural Compressor 2.5.0 - SQL Injection author: ritikchaddha,daffainfo...

SUSE CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

DEBIAN-CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

UBUNTU-CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail is vulnerable to a Cross-Site Request Forgery (CSRF) validation bypass in the markasjunk plugin (affecting versions before 1.6.20 and 1.7.x before 1.7.5). The flaw exists because the plugin reads the _uid parameter from POST data but passes it to rcmail::get_uids() without const...

EUVD-2026-107883

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

Linux Distros Unpatched Vulnerability : CVE-2026-114719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin...

PT-2026-120951

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::get uids without constraining the input mode, so values re-read inside that...

Roundcube -- Multiple vulnerabilities

The Roundcube Mail project reports: IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action bug where an alias login wasn’t qualified by IMAP host Add a size limit to the CSS proxy content processing SSRF filter islocalurl bypass via NAT64 64:ff9b::/96 remote...

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories. - Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a...

CVE-2026-96260

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

EUVD-2026-84870

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...