Webmail Security

Roundcube Security Update Fixes 12 Webmail Flaws Roundcube Webmail security update patching a zero-click stored XSS and SSRF bypass across versions 1.6.19 and 1.7.4

Roundcube Webmail security update patching a zero-click stored XSS and SSRF bypass across versions 1.6.19 and 1.7.4

Roundcube Security Update Fixes 12 Webmail Flaws

Do Son September 6, 2026

Roundcube shipped a security update on September 6, 2026. The Roundcube security update patches 12 vulnerabilities across...

Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433 Roundcube zero-click XSS warning showing CVE-2026-54433 stored XSS in plain-text email rendering

Roundcube zero-click XSS warning showing CVE-2026-54433 stored XSS in plain-text email rendering

Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433

Do Son July 9, 2026

TL;DR Roundcube shipped versions 1.7.2 and 1.6.17 to fix six security bugs. The headline flaw is a...

Roundcube Webmail Hits Critical Update: New Security Fixes Target Hidden Vulnerabilities Roundcube Webmail security updates Roundcube Webmail Security Roundcube 1.6.14 Update

Roundcube Webmail security updates Roundcube Webmail Security Roundcube 1.6.14 Update

Roundcube Webmail Hits Critical Update: New Security Fixes Target Hidden Vulnerabilities

Do Son March 23, 2026

Roundcube Webmail has released a high-priority security update, version 1.6.14, aimed at patching several significant vulnerabilities that...

Zimbra XSS Zero-Day (CVE-2025-27915) Actively Exploited; CISA Adds to KEV Catalog State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

Zimbra XSS Zero-Day (CVE-2025-27915) Actively Exploited; CISA Adds to KEV Catalog

Do Son October 8, 2025

A cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) — tracked as CVE-2025-27915 — has...

CVE-2025-49113: Roundcube RCE Exploit Unveiled—The Swiss Army Knife of Webmail Just Got a Weaponized Blade Roundcube Vulnerability CVE-2025-49113 exploit

Roundcube Vulnerability CVE-2025-49113 exploit

CVE-2025-49113: Roundcube RCE Exploit Unveiled—The Swiss Army Knife of Webmail Just Got a Weaponized Blade

Do Son June 5, 2025

In a stunningly fast-moving sequence of events, a serious vulnerability in the widely-used Roundcube webmail client—CVE-2025-49113—has been...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-86218CVSS 10.0
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-67278CVSS 6.3
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-67279CVSS 6.9
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-67281CVSS 8.7
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-86060CVSS 9.2
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character,...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-67277CVSS 8.8
RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-67276CVSS 9.2
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized...
Admin intel📅 Updated: Sep 7, 2026
CVE-2026-14894CVSS 9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload...
Admin intel📅 Updated: Sep 4, 2026