low · CVSS v3 3.7

CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk actio…

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be taken from the query string and the action carried out without a valid CSRF token. Upstream fixed this in the commit “Fix CSRF validation bypass in the mark-as-junk action”, which passes rcube_utils::INPUT_POST explicitly.

Scores

Severity
low
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.

View analysis

low

CVE-2026-98869

A logic error in the Linux kernel's BPF verifier on s390 architectures could allow incorrect zero-extension handling for 32-bit operations. This flaw may permit arbitrary values to be injected into the upper half of registers under specific verification path conditions. The issue is resolved by replacing dynamic liveness tracking with static register analysis.

View analysis

low

CVE-2026-104642

A price manipulation vulnerability exists in the Simple Shopping Cart WordPress plugin prior to version 5.3.3. Users with Contributor privileges or higher can override product prices, allowing any visitor to purchase items at the manipulated cost. This issue compromises the integrity of e-commerce transactions on affected sites.

View analysis

low

CVE-2026-114236

A resource exhaustion vulnerability exists in the storage package of a container runtime or image processing library. Malicious or corrupt archive layers can cause file descriptor leaks during application. Repeated exploitation can exhaust the process's file descriptor limit, leading to denial of service.

View analysis