email header injection

Roundcube Security Update Fixes 12 Webmail Flaws Roundcube Webmail security update patching a zero-click stored XSS and SSRF bypass across versions 1.6.19 and 1.7.4

Roundcube Webmail security update patching a zero-click stored XSS and SSRF bypass across versions 1.6.19 and 1.7.4

Roundcube Security Update Fixes 12 Webmail Flaws

Do Son September 6, 2026

Roundcube shipped a security update on September 6, 2026. The Roundcube security update patches 12 vulnerabilities across...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-88772
Memory overflow vulnerability leading to remote code execution or denial of service.
Admin intel📅 Updated: Sep 27, 2026
CVE-2026-88771
Remote code execution due to improper input validation that can allow an unauthenticated attacker to execute arbitrary commands.
Admin intel📅 Updated: Sep 27, 2026
CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 23, 2026
CVE-2026-94127CVSS 9.8
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026

CVE-2026-100886CVSS 10.0
A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown...
📅 Updated: Sep 27, 2026
CVE-2026-88771CVSS 9.5
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37,...
📅 Updated: Sep 27, 2026
CVE-2026-88772CVSS 9.5
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before...
📅 Updated: Sep 27, 2026
CVE-2026-101090CVSS 9.3
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host...
📅 Updated: Sep 27, 2026
CVE-2026-101065CVSS 9.3
Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker...
📅 Updated: Sep 27, 2026
CVE-2026-101084CVSS 9.3
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user...
📅 Updated: Sep 27, 2026
CVE-2026-88773CVSS 9.3
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This...
📅 Updated: Sep 27, 2026
CVE-2026-100741CVSS 9.8
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows,...
📅 Updated: Sep 27, 2026