ThreatsDay: Bluesky phishing, Laravel bypass, NVIDIA AIStore flaw
Bluesky suspended over 4,500 phished accounts; Laravel 12.68.0 and 13.29.0 fix CVE-2026-114509, and Roundcube shipped 20 fixes.
Stories per day · 30 days
2 RSS
Relatedssrf2webmail2apt281bluesky1canada1command-injection1glpi1incomplete-patch1laravel1ntlm1nvidia-aistore1phishing1windows1xss1
12 stories, newest first · one card per story
Stories tagged #roundcube
Roundcube Webmail before 1.6.20 and 1.7.5 has security flaws
Canadian advisory AV26-1075 names the fixed releases but gives no CVE identifiers or impact details.
Roundcube webmail fixes injection, XSS and SSRF flaws
Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
1
Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild
Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.
4
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.
2
Roundcube SQLi (CVE-2026-48842) Exploited
Pre-authentication Roundcube Webmail SQL injection CVE-2026-48842 is reportedly exploited months after patches.
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
8
Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication
Unauthenticated SQL injection CVE-2026-48842 in Roundcube Webmail is being actively exploited on unpatched servers.
6
Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild
Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.
3
Roundcube security advisory (AV26-503) – Update 1
Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.