CVE-2026-113386

A flaw was found in Roundcube Webmail. A remote authenticated attacker can exploit this vulnerability by injecting Carriage Return and Line Feed CRLF sequences into the uid parameter during message header or source viewing requests. This flaw enables the attacker to execute arbitrary Internet...

SUSE CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

DEBIAN-CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail is vulnerable to IMAP command injection in versions before 1.6.20 and 1.7.x before 1.7.5. A remote authenticated attacker can exploit this by injecting CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions. This allows the execution of arbitrary ...

EUVD-2026-104794

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

Linux Distros Unpatched Vulnerability : CVE-2026-113386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequenc...

PT-2026-118241

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some since fixed server-side bugs. 252216 Low CVE-2013-2867: Block pop-unders in various scenarios. 252062 High CVE-2013-2879: Confusion setting up sign-in and...

CVE-2000-0474: Undefined Security Weakness

Real Networks RealServer 7.x allows remote attackers to cause a denial of service via a malformed request for a page in the viewsource directory...