Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.
EPSS < 0.01 CVE-2026-107145 CVE-2026-107147 Roundcube twofactor_gauthenticator PL
Serial Number: AV26-1075 Date: October 22, 2026 As of October 19, 2026, Roundcube is affected by vulnerabilities in the following product: Roundcube Webmail Prior to 1.6.20 Prior to 1.7.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security updates 1.6.20 and 1.7.5 released Roundcube Open Source Webmail Software
Roundcube CA
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.
Roundcube FI
Rilasciati aggiornamenti di sicurezza per risolvere 20 vulnerabilità, di cui 6 con gravità “alta”, in Roundcube Webmail, noto gestore di posta elettronica open source. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un attaccante remoto di eludere meccanismi di sicurezza e di manipolare dati e contenuti sui sistemi interessati.
EPSS 0.01 CVE-2026-113386 CVE-2026-114716 CVE-2026-114720 CVE-2026-114724 CVE-2026-114727 CVE-2026-114730 Roundcube IT
Rilasciati aggiornamenti di sicurezza per risolvere una vulnerabilità con gravità “alta” in Roundcube Webmail, noto gestore di posta elettronica open source. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante remoto autenticato di eseguire comandi IMAP arbitrari sui sistemi target.
EPSS 0.01 CVE-2026-113386 Roundcube IT
De multiples vulnérabilités ont été découvertes dans Roundcube Webmail. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS).
Roundcube FR
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]
CVE-2020-12641 * CVE-2020-35730 * CVE-2021-44026 * CVE-2023-5631 * CVE-2025-49113 * CVE-2025-68461 * CVE-2026-48842 * Roundcube US
Serial number: AV26-503Date: May 25, 2026Updated: September 21, 2026 On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product: Roundcube Webmail – versions prior to 1.6.16 Roundcube Webmail – versions prior to 1.7.1 Update 1 Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Roundcube Webmail 1…
EPSS 0.02 CVE-2026-48842 Roundcube CA FR
De multiples vulnérabilités ont été découvertes dans Roundcube Webmail. Certaines d'entre elles permettent à un attaquant de provoquer une falsification de requêtes côté serveur (SSRF), une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Roundcube FR
De multiples vulnérabilités ont été découvertes dans Roundcube. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).
EPSS 0.01 CVE-2026-74997 CVE-2026-74998 CVE-2026-74999 CVE-2026-75000 CVE-2026-75002 CVE-2026-75004 CVE-2026-75006 CVE-2026-75007 CVE-2026-75010 Roundcube FR
Aggiornamenti di sicurezza sanano 8 vulnerabilità, di cui 4 con gravità “alta” in Roundcube Webmail, noto gestore di posta elettronica open source.
EPSS 0.02 CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48848 Roundcube IT