DEBIAN-CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

DEBIAN-CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

CVE-2026-114716

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a mail header injection vulnerability. The root cause lies in the rcmail_sendmail::extract_inline_images() function, which fails to validate the media type retrieved from inline image data URIs. A remote authenticat...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

CVE-2026-114716

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heade...

PT-2026-120953

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled actions by requesting it through its deprecate...

CVE-2026-114135

A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated user with restricted privileges can exploit this flaw to open...

CVE-2026-114477

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114475

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

CVE-2026-114477 Missing Authorization in hMailServer

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114477

Progressive Robot hMailServer versions 6.2.25 through 6.3.6 are affected by a Missing Authorization vulnerability in the REST metrics route. The GET /api/v1/metrics/history endpoint fails to restrict access for credentials confined to specific named domains, allowing these users to view server-wi...

EUVD-2026-107320

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114475 Missing Authorization in hMailServer

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

CVE-2026-114475

Progressive Robot hMailServer versions 6.3.4 through 6.3.6 are vulnerable to missing authorization in the REST role-management routes. The root cause is an authorization gate failure that allows a remote authenticated user with a credential confined to specific named domains to access routes requ...

EUVD-2026-107318

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

Security Bulletin: Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-81209)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-81209 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to...

EUVD-2026-106862

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

PT-2026-120653

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any tha...

PT-2026-120655

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...