https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 27 Sep 2026 21:35:04 +0000 https://vulnerability.circl.lu/sighting/6d0c2f14-72f2-43b0-90c8-486e4bbdd4db/export {"uuid": "6d0c2f14-72f2-43b0-90c8-486e4bbdd4db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103527", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 11:35:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48842 PoC \u2014 Roundcube virtuser_query pre-auth SQLi\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T12:00:07.000000Z"} {"uuid": "6d0c2f14-72f2-43b0-90c8-486e4bbdd4db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103527", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 11:35:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48842 PoC \u2014 Roundcube virtuser_query pre-auth SQLi\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T12:00:07.000000Z"} https://vulnerability.circl.lu/sighting/6d0c2f14-72f2-43b0-90c8-486e4bbdd4db/export Sun, 27 Sep 2026 12:00:07 +0000 https://vulnerability.circl.lu/sighting/fccc6746-ac55-478c-962e-bd4dd60a0308/export {"uuid": "fccc6746-ac55-478c-962e-bd4dd60a0308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwgppzikrs2h", "content": "Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 https://redoracle.com/News/attackers-target-unpatched-roundcube-servers-with-cve-2026-48842.html #roundcube #servers #2026", "creation_timestamp": "2026-09-26T16:35:33.960213Z"} {"uuid": "fccc6746-ac55-478c-962e-bd4dd60a0308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwgppzikrs2h", "content": "Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 https://redoracle.com/News/attackers-target-unpatched-roundcube-servers-with-cve-2026-48842.html #roundcube #servers #2026", "creation_timestamp": "2026-09-26T16:35:33.960213Z"} https://vulnerability.circl.lu/sighting/fccc6746-ac55-478c-962e-bd4dd60a0308/export Sat, 26 Sep 2026 16:35:33 +0000 https://vulnerability.circl.lu/sighting/47cad66d-afd7-47a9-91c7-279c407de0b2/export {"uuid": "47cad66d-afd7-47a9-91c7-279c407de0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48482", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgm2w5op52o", "content": "CVE-2026-48482 - glpi\nVersions 11.0.0 through 11.0.7 of the GLPI IT management tool let a user with form\u2011admin rights upload a specially crafted image that is saved outside the intended folder. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#glpi #glpiproject #CVE #infosec", "creation_timestamp": "2026-09-26T15:30:04.628382Z"} {"uuid": "47cad66d-afd7-47a9-91c7-279c407de0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48482", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgm2w5op52o", "content": "CVE-2026-48482 - glpi\nVersions 11.0.0 through 11.0.7 of the GLPI IT management tool let a user with form\u2011admin rights upload a specially crafted image that is saved outside the intended folder. This can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#glpi #glpiproject #CVE #infosec", "creation_timestamp": "2026-09-26T15:30:04.628382Z"} https://vulnerability.circl.lu/sighting/47cad66d-afd7-47a9-91c7-279c407de0b2/export Sat, 26 Sep 2026 15:30:04 +0000 https://vulnerability.circl.lu/sighting/e1d564b0-843c-414c-8c7c-1f3fff72cc94/export {"uuid": "e1d564b0-843c-414c-8c7c-1f3fff72cc94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwfx7p5iu22d", "content": "Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild\n\nThe Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.\n\nThe vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a\u2026\n#hackernews #news", "creation_timestamp": "2026-09-26T09:16:56.491136Z"} {"uuid": "e1d564b0-843c-414c-8c7c-1f3fff72cc94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwfx7p5iu22d", "content": "Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild\n\nThe Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.\n\nThe vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a\u2026\n#hackernews #news", "creation_timestamp": "2026-09-26T09:16:56.491136Z"} https://vulnerability.circl.lu/sighting/e1d564b0-843c-414c-8c7c-1f3fff72cc94/export Sat, 26 Sep 2026 09:16:56 +0000 https://vulnerability.circl.lu/sighting/b604fee7-ffae-4244-802b-53a1161f4ff1/export {"uuid": "b604fee7-ffae-4244-802b-53a1161f4ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwfprv7aye2j", "content": "Just another Tuesday in IT, with the Canadian Centre for Cyber Security warning that a Roundcube Webmail pre-auth SQL injection bug, CVE-2026-48842, is being actively exploited. Anyone running Roundcube Webmail gets to suffer through this entirely predictable nightmare. Staying s...\n\nRead full story", "creation_timestamp": "2026-09-26T07:03:56.854825Z"} {"uuid": "b604fee7-ffae-4244-802b-53a1161f4ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwfprv7aye2j", "content": "Just another Tuesday in IT, with the Canadian Centre for Cyber Security warning that a Roundcube Webmail pre-auth SQL injection bug, CVE-2026-48842, is being actively exploited. Anyone running Roundcube Webmail gets to suffer through this entirely predictable nightmare. Staying s...\n\nRead full story", "creation_timestamp": "2026-09-26T07:03:56.854825Z"} https://vulnerability.circl.lu/sighting/b604fee7-ffae-4244-802b-53a1161f4ff1/export Sat, 26 Sep 2026 07:03:56 +0000 https://vulnerability.circl.lu/sighting/f4b830fb-52c8-4f12-91e3-34b51af2761c/export {"uuid": "f4b830fb-52c8-4f12-91e3-34b51af2761c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/dastechno.com/post/3mwfcpzepcw2z", "content": "Roundcube-L\u00fccke CVE-2026-48842 wird angegriffen: jetzt updaten\n\nEine Sicherheitsl\u00fccke im Webmailer Roundcube, die seit Mai gepatcht ist, wird inzwischen aktiv angegriffen. Wer betroffen ist, was Admins jetzt pr\u00fcfen sollten und was die DSGVO verlangt.\n\n#News", "creation_timestamp": "2026-09-26T03:10:15.813597Z"} {"uuid": "f4b830fb-52c8-4f12-91e3-34b51af2761c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/dastechno.com/post/3mwfcpzepcw2z", "content": "Roundcube-L\u00fccke CVE-2026-48842 wird angegriffen: jetzt updaten\n\nEine Sicherheitsl\u00fccke im Webmailer Roundcube, die seit Mai gepatcht ist, wird inzwischen aktiv angegriffen. Wer betroffen ist, was Admins jetzt pr\u00fcfen sollten und was die DSGVO verlangt.\n\n#News", "creation_timestamp": "2026-09-26T03:10:15.813597Z"} https://vulnerability.circl.lu/sighting/f4b830fb-52c8-4f12-91e3-34b51af2761c/export Sat, 26 Sep 2026 03:10:15 +0000 https://vulnerability.circl.lu/sighting/257e15b6-08c5-4362-a398-af18e919b384/export {"uuid": "257e15b6-08c5-4362-a398-af18e919b384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/VulnerabilityNews/44615", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "creation_timestamp": "2026-09-25T23:00:56.000000Z"} {"uuid": "257e15b6-08c5-4362-a398-af18e919b384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/VulnerabilityNews/44615", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "creation_timestamp": "2026-09-25T23:00:56.000000Z"} https://vulnerability.circl.lu/sighting/257e15b6-08c5-4362-a398-af18e919b384/export Fri, 25 Sep 2026 23:00:56 +0000 https://vulnerability.circl.lu/sighting/4bd32b4a-fa2c-4a81-9544-7ff68007e954/export {"uuid": "4bd32b4a-fa2c-4a81-9544-7ff68007e954", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48482", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwel4guig62o", "content": "\ud83d\udea8 CVE-2026-48482 \u2014 CVSS 9.4 CRITICAL\n\nGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-48482\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T20:07:42.242146Z"} {"uuid": "4bd32b4a-fa2c-4a81-9544-7ff68007e954", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48482", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwel4guig62o", "content": "\ud83d\udea8 CVE-2026-48482 \u2014 CVSS 9.4 CRITICAL\n\nGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-48482\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T20:07:42.242146Z"} https://vulnerability.circl.lu/sighting/4bd32b4a-fa2c-4a81-9544-7ff68007e954/export Fri, 25 Sep 2026 20:07:42 +0000 https://vulnerability.circl.lu/sighting/543376b7-000d-4acf-8588-858a6d5fc53e/export {"uuid": "543376b7-000d-4acf-8588-858a6d5fc53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117333123897233909", "content": "\ud83d\udea8 Roundcube SQL injection flaw actively exploited months after patches were released\nThe Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild.\u2800Roundcube is an open-source webmail application that lets people access email through a browser.\nThe flaw affects its virtuser_query plugin and allows SQL injection before authentication.\u2800Key details:\n\u2022 CVSS score: 8.1\u2022 No attacker credentials required\u2022 No user interaction required\u2022 Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1\u2800Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting.\nThe advisory does not identify the attackers, victims or scale of exploitation.\u2800Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities.\nSource: https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "creation_timestamp": "2026-09-25T18:36:28.270327Z"} {"uuid": "543376b7-000d-4acf-8588-858a6d5fc53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117333123897233909", "content": "\ud83d\udea8 Roundcube SQL injection flaw actively exploited months after patches were released\nThe Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild.\u2800Roundcube is an open-source webmail application that lets people access email through a browser.\nThe flaw affects its virtuser_query plugin and allows SQL injection before authentication.\u2800Key details:\n\u2022 CVSS score: 8.1\u2022 No attacker credentials required\u2022 No user interaction required\u2022 Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1\u2800Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting.\nThe advisory does not identify the attackers, victims or scale of exploitation.\u2800Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities.\nSource: https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "creation_timestamp": "2026-09-25T18:36:28.270327Z"} https://vulnerability.circl.lu/sighting/543376b7-000d-4acf-8588-858a6d5fc53e/export Fri, 25 Sep 2026 18:36:28 +0000 https://vulnerability.circl.lu/sighting/8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf/export {"uuid": "8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mweavhvlf42h", "content": "Unauthenticated SQLi (CVE-2026-48842) in Roundcube's virtuser_query plugin lets attackers steal mail data. Patches were out in May '26. That it's still actively exploited makes me intrigued and worried about patching ...", "creation_timestamp": "2026-09-25T17:04:57.566916Z"} {"uuid": "8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mweavhvlf42h", "content": "Unauthenticated SQLi (CVE-2026-48842) in Roundcube's virtuser_query plugin lets attackers steal mail data. Patches were out in May '26. That it's still actively exploited makes me intrigued and worried about patching ...", "creation_timestamp": "2026-09-25T17:04:57.566916Z"} https://vulnerability.circl.lu/sighting/8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf/export Fri, 25 Sep 2026 17:04:57 +0000