修复版本
影响 1.7 的 CVE
| CVE | 标题 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|
| CVE-2026-114716 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | 8.5 | — | 2026-10-22 | |
| CVE-2026-114727 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when... | 8.3 | — | 2026-10-22 | |
| CVE-2026-114724 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session... | 7.4 | — | 2026-10-22 | |
| CVE-2026-114730 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery fil... | 7.2 | — | 2026-10-22 | |
| CVE-2026-114720 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.... | 7.1 | — | 2026-10-22 | |
| CVE-2026-113386 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authen... | 7.1 | — | 2026-10-20 | |
| CVE-2026-114715 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability... | 6.8 | — | 2026-10-22 | |
| CVE-2026-114732 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability... | 6.8 | — | 2026-10-22 | |
| CVE-2026-114722 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. r... | 6.5 | — | 2026-10-22 | |
| CVE-2026-114726 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in... | 5.8 | — | 2026-10-22 | |
| CVE-2026-114714 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the sq... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114731 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vul... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114728 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114729 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114725 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | 5.0 | — | 2026-10-22 | |
| CVE-2026-114718 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in... | 4.7 | — | 2026-10-22 | |
| CVE-2026-114717 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability wh... | 4.0 | — | 2026-10-22 | |
| CVE-2026-114719 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-... | 3.7 | — | 2026-10-22 | |
| CVE-2026-114723 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed d... | 3.7 | — | 2026-10-22 | |
| CVE-2026-114721 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be... | 3.1 | — | 2026-10-22 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。