https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T19:02:16.742287+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-10428 cnvd-2018-10428 2026-10-04T19:02:16.758701+00:00 cnvd-2018-10428 https://cve.radiocsirt.org/vuln/euvd-2026-64374 EUVD-2026-64374 2026-10-04T19:02:16.758735+00:00 EUVD-2026-64374 https://cve.radiocsirt.org/vuln/fkie_cve-2018-9846 fkie_cve-2018-9846 2026-10-04T19:02:16.758750+00:00

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.

 https://cve.radiocsirt.org/vuln/ghsa-3v75-9ch3-wfrw GHSA-3v75-9ch3-wfrw 2026-10-04T19:02:16.758782+00:00

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.

 https://cve.radiocsirt.org/vuln/gsd-2018-9846 gsd-2018-9846 2026-10-04T19:02:16.758801+00:00 gsd-2018-9846 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11303-1 openSUSE-SU-2024:11303-1 — roundcubemail-1.4.11-1.3 on GA media 2026-10-04T19:02:16.758812+00:00

roundcubemail-1.4.11-1.3 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-9846 UBUNTU-CVE-2018-9846 2026-10-04T19:02:16.758831+00:00

Affected: Ubuntu:Pro:16.04:LTS: roundcube

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.