215 matches found
UBUNTU-CVE-2026-126813
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
CVE-2026-126813
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
CVE-2026-126813
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
CVE-2026-126813 Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
CVE-2026-126813
Roundcube Webmail versions before 1.6.21 and 1.7.x before 1.7.6 are vulnerable to an IMAP command injection vulnerability. The root cause is the improper neutralization of CRLF sequences in the _uid parameter when the messages_cache feature is enabled. An attacker can lure a logged-in victim into...
CVE-2026-126813 Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
CVE-2026-126813
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
EUVD-2026-124028
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
OESA-2026-4850 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on...
CVE-2026-126813: Roundcube Webmail: Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows…
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...
PT-2026-145470
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messages cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or...
[SECURITY] [DSA 6614-1] ruby3.3 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6614-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 07, 2026 https://www.debian.org/security/faq -...
openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:22195-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22195-1 advisory. Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently...
Security update for roundcubemail (critical)
openSUSE security update: security update for roundcubemail ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22195-1 Rating: critical References: bsc1243915 bsc1271471 bsc1271472 bsc1271474 bsc1271475 bsc1271476 bsc1271477 bsc1275317 bsc1275318...
OPENSUSE-SU-2026:22195-1 Security update for roundcubemail
This update for roundcubemail fixes the following issues: Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: + Fix IMAP command injection via CRLF in uid parameter of...
Updated roundcubemail package fixes security vulnerabilities
Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. Fix SSRF...
[SECURITY] [DSA 6579-1] roundcube security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 23, 2026 https://www.debian.org/security/faq -...
Debian dsa-6579 : roundcube - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...
PT-2026-135394
Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. Fix SSRF...
SUSE CVE-2026-114720
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...