2944 matches found
EUVD-2026-32893
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
PT-2026-44369
Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs even when remote content loading is disabled. A remote attacker can send an HTML email that causes the victim's browser to issue requests to local or private-network services...
RoundCube Webmail File Deletion
The vulnerability of the RoundCube Webmail email client is related to the lack of validation for incoming requests. Exploiting this vulnerability could allow a malicious actor to delete any files at will...
RoundCube Webmail Auth Bypass Information Disclosure
The vulnerability of the RoundCube Webmail email client is related to the lack of validation for incoming requests. Exploiting this vulnerability can allow an attacker to disclose protected information or enhance their privileges...
RoundCube preg_replace() Injection
The vulnerability of the pregreplace function in the RoundCube Webmail email client is related to the lack of security measures for handling SQL query structures. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...
RoundCube Webmail SSRF Disclosure
The vulnerability of the RoundCube Webmail email client is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack and disclose sensitive information...
RoundCube Webmail Auth Bypass Information Disclosure
The vulnerability of the RoundCube Webmail email client is related to the lack of validation during the processing of incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information or bypass existing security mechanisms...
RoundCube LDAP Code Execution
The vulnerability of the RoundCube Webmail client LDAP implementation is related to the improper handling of control flows. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
RoundCube Webmail Code Execution
The vulnerability of the RoundCube Webmail client is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created SVG document...
Debian dla-4604 : roundcube - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4604 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4604-1 [email protected]...
Debian dsa-6301 : roundcube - security update
The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6301 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected]...
[SECURITY] [DSA 6301-1] roundcube security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 27, 2026 https://www.debian.org/security/faq -...
WS-2018-0188
In Roundcube 1.2.2 and earlier, user-controlled input flows unsanitized into the fifth argument of a call to PHP’s built-in function mail which is documented as critical in terms of security...
SUSE CVE-2026-35540
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts...
SUSE CVE-2026-48842
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...
SUSE CVE-2026-48843
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix fo...
SUSE CVE-2026-48844
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. Support for code evaluation has been removed in 1.6.16 and 1.7.1...
SUSE CVE-2026-48845
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message...
SUSE CVE-2026-48846
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var value in an e-mail message, which may lead to information disclosure or access-control bypass...