Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
About this summary. This is a short, independently written summary of an article first published by SecurityWeek. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/
Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in…
Roundcube SQLi (CVE-2026-48842) Exploited
Roundcube SQLi (CVE-2026-48842) Exploited A pre-authentication SQL injection vulnerability in Roundcube Webmail is reportedly being exploited in the wild months after…
Roundcube security advisory (AV26-503) – Update 1
Serial number: AV26-503 Date: May 25, 2026 Updated: September 21, 2026 On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the…
[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)
Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-071 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0…
[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)
Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-070 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0…
[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)
Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-069 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0…