CVE-2026-54432

A flaw was found in Roundcube Webmail. This Stored Cross-Site Scripting XSS vulnerability arises from improper escaping of the attachment MIME type on the attachment-validation warning page. A remote attacker could exploit this by sending a specially crafted attachment, potentially leading to the...

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

CVE-2026-54432

Roundcube Webmail affected: versions before 1.6.17 and 1.7.x before 1.7.2 are vulnerable to a Stored XSS flaw. Root cause: the attachment MIME type is not properly escaped on the attachment-validation warning page, enabling script execution within a victim’s session when an email is viewed. Affec...

Malicious Package

Overview tinyparrot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview kraken-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-54432: Improper Neutralization of Input During Web Page Generation

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets. That's the shape of this week. Trusted code turns on the...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

Fedora 44 : composer (2026-22ba02bee3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-22ba02bee3 advisory. Version 2.10.2 - 2026-07-01 Security: Validate package names GHSA-499r-g7pc-vmp9 Security: Validate package bin paths against path traversal...

PT-2026-57342

Name of the Vulnerable Software and Affected Versions RoundCube versions prior to 1.7 Description A stored cross-site scripting XSS flaw exists where an unescaped attachment MIME type is displayed on the attachment-validation warning page. An attacker can craft a malicious MIME type string that,...

"Warning: Exchange account was not found"

Challenge When backing up Exchange Online mailboxes, Veeam Backup for Microsoft 365 intermittently fails to discover and process some mailboxes, reporting the following warning: Warning: Exchange account was not found The affected mailboxes vary between job runs, and in some cases, only a small...

PYSEC-2026-1105 AIOHTTP Vulnerable to Cookie Parser Warning Storm

Summary Reading multiple invalid cookies can lead to a logging storm. Impact If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header. ---- Patch:...

AIOHTTP Vulnerable to Cookie Parser Warning Storm

SummaryReading multiple invalid cookies can lead to a logging storm. ImpactIf the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.----Patch:...

MAL-2026-9285 Malicious code in wandsquery1778555184810 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1911 Sentry vulnerable to leaking superuser cleartext password in logs

Impact When authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validatesuperuser. An attacker with access to the log data could use these leaked credentials to login to the Sentry...

Malicious Package

Overview paysafe-cards is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eslint-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...