CVE-2026-126813
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject comm
CVSS
6.8
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-93
Not enough EPSS history yet.
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
- github.comhttps://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892
- github.comhttps://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80
- github.comhttps://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb
- github.comhttps://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c
- github.comhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.21
- github.comhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.6
- roundcube.nethttps://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6
- www.vulncheck.comhttps://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1267817.5 HIG—
———Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.6hCVE-2026-92441—31.8%
——10Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream.1dCVE-2026-12135310.0 CRI65.8%
——20Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.14hCVE-2026-109683—24.5%
——7A newline
injection vulnerability exists in the UPnP service of Archer BE805 v1 such that
an adjacent attacker can supply newline characters in a UPnP port-mapping
description due to improper sanitization, resulting in possible injection of unintended
content into UPnP port-mapping data.
Successful
exploitation may allow an unauthenticated attacker on the local network to
modify runtime UPnP port-mapping information and create spoofed entries within
the affected service. The issue is limited to the integrity of UPnP mapping
data and does not demonstrate code execution or privilege escalation.5dCVE-2026-1232985.0 MED51.1%
——15In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible5dCVE-2026-1230957.5 HIG42.9%
——13mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.2d