ThreatCluster

Roundcube Vulnerabilities Enable Malicious Script Execution

First seen 19 Dec 2025, 13:04 UTC • •35

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Roundcube Webmail has issued critical security updates for vulnerabilities in versions 1.6 and 1.5 LTS. These flaws, including a Cross-Site Scripting (XSS) issue in SVG handling, could allow attackers to execute malicious scripts and gain unauthorized access to sensitive information. Users are advised to update their systems promptly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

More articles in this cluster (3)

Threat Graph

6 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Malware
Cross-site Scripting

Affected Platform (2)

Roundcube
Roundcube Webmail

Vulnerability (1)

XSS

Relationships

XSS targets Roundcube
XSS targets Roundcube Webmail
Data Breach targets Roundcube
Data Breach targets Roundcube Webmail
Malware targets Roundcube
Malware targets Roundcube Webmail
Cross-site Scripting targets Roundcube
Cross-site Scripting targets Roundcube Webmail

Continue Reading

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway Sangoma Switchvox SMB Edition 8.3 is facing active exploitation of multiple vulnerabilities, particularly CVE-2026-9586, which allows unauthenticated SQL injection leading to remote code execution. The flaw can be exploited by sending crafted HTTP POST requests to the /pa endpoint, enabling attackers to execute…

Critical Stored XSS Vulnerabilities Found in SiYuan Versions Before 3.7.4 Two critical vulnerabilities, CVE-2026-73050 and CVE-2026-73052, have been identified in SiYuan versions prior to 3.7.4. CVE-2026-73050 allows attackers to exploit stored cross-site scripting (XSS) via unescaped color fields in select options, executing arbitrary JavaScript in victim browsers. CVE-2026-73052 enables…