https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:22:31.302667+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-06366 bdu:2025-06366 2026-10-04T01:22:31.307886+00:00 bdu:2025-06366 https://cve.radiocsirt.org/vuln/certfr-2025-ale-008 certfr-2025-ale-008 — <span class="important-content"><b>[Mise à jour du 06 juin 2025]</b></span></br> Une preuve de concept est publiquement… 2026-10-04T01:22:31.307917+00:00 certfr-2025-ale-008 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0468 certfr-2025-avi-0468 — Une vulnérabilité a été découverte dans Roundcube Webmail. Elle permet à un attaquant de provoquer une exécution de cod… 2026-10-04T01:22:31.307937+00:00 certfr-2025-avi-0468 https://cve.radiocsirt.org/vuln/cnvd-2025-12609 cnvd-2025-12609 2026-10-04T01:22:31.307951+00:00 cnvd-2025-12609 https://cve.radiocsirt.org/vuln/euvd-2026-269109 EUVD-2026-269109 2026-10-04T01:22:31.307963+00:00 EUVD-2026-269109 https://cve.radiocsirt.org/vuln/fkie_cve-2025-49113 fkie_cve-2025-49113 2026-10-04T01:22:31.307974+00:00

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

 https://cve.radiocsirt.org/vuln/ghsa-8j8w-wwqc-x596 GHSA-8j8w-wwqc-x596 — Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization 2026-10-04T01:22:31.307999+00:00

Affected: Packagist: roundcube/roundcubemail

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49113 UBUNTU-CVE-2025-49113 2026-10-04T01:22:31.308022+00:00

Affected: Ubuntu:Pro:16.04:LTS: roundcube, Ubuntu:Pro:18.04:LTS: roundcube, Ubuntu:Pro:20.04:LTS: roundcube, Ubuntu:Pro:22.04:LTS: roundcube, Ubuntu:24.04:LTS: roundcube

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1208 WID-SEC-W-2025-1208 — Roundcube: Schwachstelle ermöglicht Codeausführung 2026-10-04T01:22:31.308046+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Roundcube ausnutzen, um beliebigen Programmcode auszuführen.