IMAP Command Injection

Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3 Roundcube webmail RCE SSRF filter bypass security update diagram

Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3

Do Son August 15, 2026

Roundcube shipped two security updates this week. Also, versions 1.6.18 and 1.7.3 close eleven separate bugs. The...

📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo

CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intel📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-94127CVSS 9.8
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-85102CVSS 9.8
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-93616CVSS 9.8
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026

CVE-2026-93641CVSS 9.3
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient...
📅 Updated: Sep 25, 2026
CVE-2026-86473CVSS 9.1
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When...
📅 Updated: Sep 25, 2026
CVE-2026-25254CVSS 9.8
Improper authorization leads to Remote Code Execution via SocketIO interface.
📅 Updated: Sep 25, 2026
CVE-2026-85724CVSS 9.6
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes...
📅 Updated: Sep 25, 2026
CVE-2026-56315CVSS 9.8
## Summary picklescan v1.0.3 (latest) does not block at least 7 Python standard library modules that provide direct...
📅 Updated: Sep 25, 2026
CVE-2026-79766CVSS 9.1
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until...
📅 Updated: Sep 25, 2026
CVE-2026-97413CVSS 9.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write...
📅 Updated: Sep 25, 2026
CVE-2026-10579CVSS 9.8
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no...
📅 Updated: Sep 25, 2026