PT-2026-120967

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube utils::is local url omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified...

PT-2026-120948

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail sendmail::extract inline images used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part...

PT-2026-120951

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::get uids without constraining the input mode, so values re-read inside that...

PT-2026-120969

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube user::query matched the address against identity records without qualifying the lookup by IMAP host, so a...

Linux Distros Unpatched Vulnerability : CVE-2026-114714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based...

Linux Distros Unpatched Vulnerability : CVE-2026-114725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only fro...

Linux Distros Unpatched Vulnerability : CVE-2026-114716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages used the media...

Linux Distros Unpatched Vulnerability : CVE-2026-114717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The...

Linux Distros Unpatched Vulnerability : CVE-2026-114720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-114730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by...

PT-2026-120968

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

PT-2026-120949

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF...

PT-2026-120891

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause...

PT-2026-120955

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was...

PT-2026-120953

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled actions by requesting it through its deprecate...

Linux Distros Unpatched Vulnerability : CVE-2026-114715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The...

Linux Distros Unpatched Vulnerability : CVE-2026-114719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin...

Linux Distros Unpatched Vulnerability : CVE-2026-114728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcubewashtml...

Linux Distros Unpatched Vulnerability : CVE-2026-114718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a...

Linux Distros Unpatched Vulnerability : CVE-2026-114723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcubeimage falls...