Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

CVE-2023-38873-G1

🚨 G1 = A05:2021 – Security Misconfiguration ClickJacking ⚠️ Base Score: 6.5 MEDIUM Scale: CVSS ⚠️ 📌 Description This repository demonstrates a Clickjacking security flaw present on the G1 website. The vulnerability allows an attacker to load the site inside an iframe , overlaying malicious elements...

SUSE CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

A flaw was found in Roundcube Webmail. When rendering incoming HTML messages, the application fails to properly confine Cascading Style Sheets CSS styling rules to the email body. A remote attacker can exploit this issue by sending a specially crafted email that alters the surrounding webmail...

DEBIAN-CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

EUVD-2026-107887

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

CVE-2026-114722

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to a CSS scoping bypass within HTML messages. The root cause lies in the rcube_utils::mod_css_styles() function, which fails to recognize at-rule prologues (e.g., @layer a;) as selector boundaries and does not handle s...

CVE-2026-114722

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were...

PT-2026-120954

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube utils::mod css styles did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule we...

Linux Distros Unpatched Vulnerability : CVE-2026-114722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcubeutils::modcssstyles did not treat an at-rule...

CVE-2026-105784

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

EUVD-2026-92871

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784

The open-source note-taking application Joplin is vulnerable to CSS injection in versions prior to 3.7.13 . The root cause is the improper handling of jsoncanvas fences, where the TextNode.tsx and FileNode.tsx components render card content using the full Markdown renderer and insert the resultin...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...