{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/roundcube-webmail--1.7.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Roundcube Webmail (\u003c 1.6.21)","Roundcube Webmail (\u003c 1.7.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Roundcube"],"content_html":"\u003cp\u003eMultiple vulnerabilities have been identified in Roundcube Webmail, affecting versions 1.6.x prior to 1.6.21 and 1.7.x prior to 1.7.6. These vulnerabilities can allow a remote attacker to achieve arbitrary code execution, conduct Server-Side Request Forgery (SSRF), perform Cross-Site Request Forgery (CSRF), and trigger denial-of-service conditions. Security updates have been released by the vendor.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Roundcube Webmail to version 1.6.21 or 1.7.6 immediately to mitigate the identified security risks.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests or unexpected outbound connections from the web server host, which may indicate attempted exploitation of SSRF or RCE vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:33:17Z","date_published":"2026-11-10T16:33:17Z","id":"https://feed.craftedsignal.io/briefs/2026-11-roundcube-vulnerabilities/","summary":"Multiple vulnerabilities in Roundcube Webmail versions 1.6.x and 1.7.x enable remote attackers to perform arbitrary code execution, SSRF, CSRF, and denial of service.","title":"Roundcube Webmail: Multiple vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-11-roundcube-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Roundcube Webmail (\u003c 1.7.6)","version":"https://jsonfeed.org/version/1.1"}