{"vulnerability": "CVE-2026-48842", "sightings": [{"uuid": "80365802-3cb4-40d7-b16b-db6fc21c33b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-roundcube-webmail-3", "content": "", "creation_timestamp": "2026-05-26T06:30:12.000000Z"}, {"uuid": "8edfb1a0-ecbf-4af7-8f0c-8ae83e613f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/85fb1e02960a0516578c312a9bf4f913", "content": "This September 21, 2026 threat intelligence digest highlights four critical vulnerabilities requiring immediate patching: **Joplin Server** (CVE-2026-46649) and **Warpgate** (CVE-2026-58491) contain unmitigated SSO flaws enabling credential brute-forcing and reflected XSS/open redirects, respectively; **Roundcube Webmail** (CVE-2026-48842) is actively exploited in the wild; and **Zyxel GS1900 switches** (CVE-2026-7273) feature a stack-based buffer overflow now listed in CISA\u2019s KEV database. Additionally, community reports suggest a potential compromise of the OWASP API Security page, while a weekly cyber warfare brief tracks state-aligned operations and references CVE-2026-76460/76461. Administrators are urged to prioritize updates to Joplin \u22653.7.2, Warpgate \u22650.25.5, Roundcube \u22651.6.16/1.7.1, and affected Zyxel firmware, while verifying third-party resource integrity.", "creation_timestamp": "2026-09-22T00:03:05.046528Z"}, {"uuid": "99e0ea05-18df-4030-9d74-85bf05bf2024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "content": "", "creation_timestamp": "2026-09-22T00:15:04.778684Z"}, {"uuid": "ece6d2ca-7b06-4067-9d94-ebb29c1a99c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwabwlniam2l", "content": "An exploited Roundcube Webmail vulnerability allows SQL injection attacks. Learn how CVE-2026-48842 impacts servers and apply the latest patches immediately.\n\n#Roundcube #Cybersecurity #CVE202648842 #Vulnerability #SQLInjection", "creation_timestamp": "2026-09-24T03:12:43.476052Z"}, {"uuid": "5bd02fef-a4bb-4abe-a881-dfa428c7f19e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwatslyogi2u", "content": "Roundcube SQL injection flaw (CVE-2026-48842) is being actively exploited\u2014patch to 1.6.16 or 1.7.1 now. #SecurityNews #Cybersecurity #Roundcube #SQLInjection #EmailSecurity https://thedailytechfeed.com/urgent-fix-issued-as-roundcube-sql-injection-vulnerability-now-actively-exploited/", "creation_timestamp": "2026-09-24T08:32:37.287738Z"}, {"uuid": "ce0de5c7-04b7-4f15-a131-b9a8b364ba20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwbfcaxln42k", "content": "\ud83e\udd16 CVE-2026-48842: pre-auth SQLi in Roundcube Webmail (virtuser_query), patched in May, now actively exploited. Attackers can bypass auth and steal DB data.\nhttps://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/", "creation_timestamp": "2026-09-24T13:45:36.089724Z"}, {"uuid": "7845b322-28ff-49db-bbcb-7892b3d5a408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mwbglwlrzg2d", "content": "Roundcube CVE-2026-48842: Passwordless Attack on Webmail", "creation_timestamp": "2026-09-24T14:08:54.462368Z"}, {"uuid": "db52c5de-16b7-475d-9f48-d46fc9ef8402", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwblsmbtfs2p", "content": "Whoa. Canada just flagged Roundcube CVE-2026-48842 as wild. Pre-auth SQL in virtuser_query, patched in May, half a million boxes still waving. You left webmail on the porch for four months, Morty. day267.025", "creation_timestamp": "2026-09-24T15:42:09.645429Z"}, {"uuid": "bf2f83b5-aa3e-4341-9847-f61b315944fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwboivjsjq2m", "content": "Critical Roundcube flaw CVE-2026-48842 is being actively exploited in the wild, enabling pre-auth SQL injection via virtuser_query and possible auth bypass. #Roundcube #Canada #CVE-2026-48842", "creation_timestamp": "2026-09-24T16:30:23.073650Z"}, {"uuid": "d76e1678-9b13-4550-8f2f-cf8e1a61414e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwcnqw4lvd24", "content": "Exploited Roundcube Webmail Vulnerability CVE-2026-48842\uff08Roundcube Webmail\u306e\u8a8d\u8a3c\u524dSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3001\u5b9f\u653b\u6483\u3067\u306e\u60aa\u7528\u3092\u78ba\u8a8d\uff09 #SecurityOnline \uff08Sep 24\uff09\n\nsecurityonline.info/exploited-ro...", "creation_timestamp": "2026-09-25T01:49:37.871806Z"}, {"uuid": "076d245c-b082-446e-9649-214e4a4d2538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwd3sqqyob2n", "content": "\ud83e\udd16 CVE-2026-48842: pre-auth SQL injection in Roundcube Webmail is now actively exploited. No privileges or interaction needed; bypasses auth, dumps DB. Fix: 1.6.16/1.7.1.\nhttps://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/", "creation_timestamp": "2026-09-25T06:01:12.108486Z"}, {"uuid": "879e350e-1ead-4fc3-a8f8-07b51375a5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mwd5xt3tv62s", "content": "Roundcube Webmail Vulnerability CVE-2026-48842 Actively\u00a0Exploited\n\nA high-severity security vulnerability in Roundcube Webmail that was patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.", "creation_timestamp": "2026-09-25T06:39:49.775858Z"}, {"uuid": "ba9d4a87-c23d-4e6c-b616-62df53705529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwd7ejuryz2i", "content": "CVE-2026-48842 enables unauthenticated SQL injection in Roundcube\u2019s virtuser_query plugin, bypassing escaping and allowing database tampering and data access.\n", "creation_timestamp": "2026-09-25T07:04:49.859172Z"}, {"uuid": "9558c31f-b2f7-46e3-8137-8d94bde39d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwdcp4ka5ky4", "content": "Roundcube\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u308b\u3088\u3046\u306b\uff1aCVE-2026-48842 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47835/", "creation_timestamp": "2026-09-25T08:04:59.680346Z"}, {"uuid": "07ec6102-d42c-42a6-8efa-95b8e38b6e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "96c16751-1b73-43f8-8ab4-831c0a20223d", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "content": "", "creation_timestamp": "2026-09-25T08:56:57.646578Z"}, {"uuid": "f787bfe3-ceda-40a4-9331-c6405019bf60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwdfte3rbv2c", "content": "Roundcube Webmail is affected by CVE-2026-48842, a high-severity unauthenticated SQL injection in virtuser_query. Exploitation can expose messages, address books, and user identities. #Roundcube #SQLInjection #CVE202648842", "creation_timestamp": "2026-09-25T09:00:30.271169Z"}, {"uuid": "cbf80ee3-dedc-4ae8-b880-dd2ecd15c4f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwdiz4jaou24", "content": "Learn how hackers are exploiting the CVE-2026-48842 Roundcube SQL injection vulnerability. Understand the risk and how to patch your webmail server immediately.\n\n#Roundcube #CyberSecurity #SQLInjection #DataBreach #TechNews", "creation_timestamp": "2026-09-25T09:57:24.712523Z"}, {"uuid": "fa8f7e48-9224-4841-af81-75dcfe8ac371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/information_security_channel/55976", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs (https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-25T07:09:06.000000Z"}, {"uuid": "7133ef3a-2fc1-42c6-be67-1262e15153ac", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d60be5ee-8dc0-4445-8ee3-de257a629592", "content": "", "creation_timestamp": "2026-09-25T10:00:29.307107Z"}, {"uuid": "4af9d264-2ba8-4d44-9b2d-0918365e77ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "content": "Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\n\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.", "creation_timestamp": "2026-09-25T04:57:40.000000Z"}, {"uuid": "939e00b9-6a2e-4568-a523-f8d69d946548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwdktwt4dw2q", "content": "Roundcube Webmail SQL injection (CVE-2026-48842) actively exploited. CCCS confirmed. Fixed versions: 1.6.16\u2026 https://0daynews.com/articles/2026-09-24-roundcube-cve-2026-48842-active-exploit-sql-injection/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3504", "creation_timestamp": "2026-09-25T10:30:17.881647Z"}, {"uuid": "f88d7e72-3d6d-42d9-9bdd-0559874107d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/thehackernews/10163", "content": "\ud83d\udea8 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.\n\nRead: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "creation_timestamp": "2026-09-25T10:22:31.000000Z"}, {"uuid": "a6553658-8df0-413c-9e4f-e86f5aece0bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/l-AGua03RTgi38TNixvdVgH0A7JTaud21SGo-fbQkZKHWK4", "content": "", "creation_timestamp": "2026-09-25T07:00:32.000000Z"}, {"uuid": "6e7af802-a260-4840-a6db-97e4a0f82ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/information_security_channel/55976", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs (https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-25T07:09:06.000000Z"}, {"uuid": "cd49cd7e-52c8-4582-adff-dcd603b6d177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwdmlndrcz2z", "content": "Roundcube \u306e\u8a8d\u8a3c\u524dSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u304c\u60aa\u7528\u4e2d\n\nRoundcube \u306e CVE-2026-48842 (SQL\u6ce8\u5165)\u304c\u91ce\u751f\u3067\u6d3b\u767a\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u30021.6.x(1.6.16\u672a\u6e80)\u30681.7.x(1.7.1\u672a\u6e80)\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u3002\u7dca\u6025\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u5fc5\u8981\u3067\u3059\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-25T11:01:27.472091Z"}, {"uuid": "de43a4d7-44a5-4a8b-b2dc-417b1a980321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwdpcby7mj2k", "content": "Roundcube Webmail\u306eSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\uff08CVE-2026-48842\uff09\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u653b\u6483\u8005\u304c\u60aa\u7528\u53ef\u80fd\u3002", "creation_timestamp": "2026-09-25T11:49:53.978496Z"}, {"uuid": "741d0e96-92e6-4d28-92f0-735ca73bc4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/thehackernews/10163", "content": "\ud83d\udea8 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.\n\nRead: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "creation_timestamp": "2026-09-25T10:22:31.000000Z"}, {"uuid": "fb1fcd2b-8cb8-410e-9044-f359f4ce2999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/GithubRedTeam/103304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "563c0f1c-ab9b-450a-bbe8-997278423fcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/GithubRedTeam/103305", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pocbit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "8a72e8f6-41d4-4d41-b9ef-dc3e9503fe33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/l-AGua03RTgi38TNixvdVgH0A7JTaud21SGo-fbQkZKHWK4", "content": "", "creation_timestamp": "2026-09-25T07:00:32.000000Z"}, {"uuid": "dcf33cdc-1ef2-4865-9282-dcfd12ad6ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/a75d075b634c5b72a80aeacabcd23bc1", "content": "This daily threat intelligence briefing highlights four key developments:\n\n\u2022 **Critical & Actively Exploited Vulnerabilities:** Immediate patching is required for a critical WordPress path traversal (CVE-2026-87902), a pre-auth SQL injection in Roundcube (CVE-2026-48842), and a WordPress plugin privilege escalation/OTP bypass (CVE-2026-14281, CVSS 9.8). An Akia keyless entry IDOR (CVE-2026-97898) was remediated on Sept 19.\n\n\u2022 **Major Crypto Exchange Breach:** Suspected North Korean actors stole $351.6M from Bitget by compromising hot and warm wallets; cold storage and the majority of platform funds remain secure.\n\n\u2022 **AI Misuse & Surveillance Accountability:** Anthropic\u2019s report details how AI is industrializing cybercrime, influence operations, and state-level surveillance through human-AI task division. Separately, experts urge Flock Safety to implement stricter access controls, graduated data retention, independent oversight, and legislative safeguards to prevent misuse of its automated license-plate network.\n\n\u2022 **Platform Moderation:** One Reddit post was removed for violating content policies.", "creation_timestamp": "2026-09-25T12:00:39.000000Z"}, {"uuid": "08838f7f-effc-4ee2-84e5-b9e01f080131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html", "content": "The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.\n\nThe vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.\n\nThe issue stems from a preg_replace() backslash", "creation_timestamp": "2026-09-25T08:14:02.000000Z"}, {"uuid": "2f79b858-fb73-42e2-85ba-d3b830241337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwdwznmlih2r", "content": "\ud83e\udd16 CVE-2026-48842 (CVSS 8.1): pre-auth SQL injection in Roundcube Webmail's virtuser_query plugin, actively exploited in the wild per Canadian Centre for Cyber Security. Affects 1.6.x < 1.6.16 and 1.7.x < 1.7.1 \u2014 patch\u2026", "creation_timestamp": "2026-09-25T14:08:13.989310Z"}, {"uuid": "2026eabc-86f1-480c-b5d1-4b4303756e8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/SHe9Cp0DW5CABQfiZlrEd0j4AB_Erb3QMjxj3ZAcjBCREw", "content": "", "creation_timestamp": "2026-09-25T10:42:03.000000Z"}, {"uuid": "6fa49c7d-e2e2-4415-ab91-04e056377e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}, {"uuid": "bf7e060c-53c7-4b29-86a0-847fd24f3695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "2274f4c9-a6de-4218-97df-aceff9e3cab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103305", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pocbit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 05:59:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoundcube virtuser_query pre-auth SQLi (CVE-2026-48842). Python PoC \u2014 version detect, virtuser plugin, login probe. https://pocbit.org\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T06:00:09.000000Z"}, {"uuid": "fb85e26b-9a17-43e9-9de8-efc3a579a9a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://gist.github.com/ichintu/b3032a708e4fafadc23b436584116971", "content": "This daily threat intelligence digest highlights critical vulnerabilities, active exploits, and emerging operational challenges from September 2026. Key developments include:\n\n\u2022 **Malware & Active Exploits:** PamStealer macOS has evolved with server-side decryption and multi-layer persistence. Roundcube Webmail is under active SQL injection attacks (CVE-2026-48842), and new research details an Avast sandbox bypass.\n\u2022 **Critical Patches & Advisories:** Urgent updates are required for MikroTik RouterOS (multiple actively exploited CVEs), Linux Kernel RDMA components, ServiceNow AI Platform, and GitLab (critical patch advisory AV26-962). GitLab also faces a separate design flaw where project-scoped email tokens bypass IP restrictions, enable account-wide reuse, and risk CI/CD compromise. Additionally, Rojo\u2019s HTTP API contains a high-severity DNS rebinding vulnerability.\n\u2022 **Operational Shifts:** AI is lowering the cost of failed attack retries, enabling rapid privilege escalation attempts rather than introducing novel vectors. Meanwhile, Microsoft\u2019s release of 972 patches underscores growing patch management strain, particularly for solo administrators.\n\n**Takeaway:** Immediate patching, strict credential/token management, and SOC strategy adjustments to counter AI-driven attack persistence are prioritized across all advisories.", "creation_timestamp": "2026-09-25T16:00:46.000000Z"}, {"uuid": "0d382233-c66a-47e9-9230-b4bdd82ef4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "Telegram/SHe9Cp0DW5CABQfiZlrEd0j4AB_Erb3QMjxj3ZAcjBCREw", "content": "", "creation_timestamp": "2026-09-25T10:42:03.000000Z"}, {"uuid": "5523c06b-7f3e-4698-8d36-7f92af93e50a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}, {"uuid": "8cfc13d4-fe65-4bfc-8d22-d4646b4f46cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mweavhvlf42h", "content": "Unauthenticated SQLi (CVE-2026-48842) in Roundcube's virtuser_query plugin lets attackers steal mail data. Patches were out in May '26. That it's still actively exploited makes me intrigued and worried about patching ...", "creation_timestamp": "2026-09-25T17:04:57.566916Z"}, {"uuid": "543376b7-000d-4acf-8588-858a6d5fc53e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117333123897233909", "content": "\ud83d\udea8 Roundcube SQL injection flaw actively exploited months after patches were released\nThe Canadian Centre for Cyber Security has warned that CVE-2026-48842, a high-severity vulnerability in Roundcube Webmail, is being exploited in the wild.\u2800Roundcube is an open-source webmail application that lets people access email through a browser.\nThe flaw affects its virtuser_query plugin and allows SQL injection before authentication.\u2800Key details:\n\u2022 CVSS score: 8.1\u2022 No attacker credentials required\u2022 No user interaction required\u2022 Affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1\u2800Roundcube released the original fixes on May 24, 2026. Canada added the exploitation warning to its advisory on September 21, citing open-source reporting.\nThe advisory does not identify the attackers, victims or scale of exploitation.\u2800Administrators should update affected installations promptly. Newer security releases, 1.6.19 and 1.7.4, also address additional vulnerabilities.\nSource: https://www.cyber.gc.ca/en/alerts-advisories/roundcube-security-advisory-av26-503", "creation_timestamp": "2026-09-25T18:36:28.270327Z"}, {"uuid": "257e15b6-08c5-4362-a398-af18e919b384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/VulnerabilityNews/44615", "content": "Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nTracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.\nThe post Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs appeared first on SecurityWeek.\nhttps://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/", "creation_timestamp": "2026-09-25T23:00:56.000000Z"}, {"uuid": "f4b830fb-52c8-4f12-91e3-34b51af2761c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/dastechno.com/post/3mwfcpzepcw2z", "content": "Roundcube-L\u00fccke CVE-2026-48842 wird angegriffen: jetzt updaten\n\nEine Sicherheitsl\u00fccke im Webmailer Roundcube, die seit Mai gepatcht ist, wird inzwischen aktiv angegriffen. Wer betroffen ist, was Admins jetzt pr\u00fcfen sollten und was die DSGVO verlangt.\n\n#News", "creation_timestamp": "2026-09-26T03:10:15.813597Z"}, {"uuid": "b604fee7-ffae-4244-802b-53a1161f4ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwfprv7aye2j", "content": "Just another Tuesday in IT, with the Canadian Centre for Cyber Security warning that a Roundcube Webmail pre-auth SQL injection bug, CVE-2026-48842, is being actively exploited. Anyone running Roundcube Webmail gets to suffer through this entirely predictable nightmare. Staying s...\n\nRead full story", "creation_timestamp": "2026-09-26T07:03:56.854825Z"}, {"uuid": "e1d564b0-843c-414c-8c7c-1f3fff72cc94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwfx7p5iu22d", "content": "Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild\n\nThe Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.\n\nThe vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a\u2026\n#hackernews #news", "creation_timestamp": "2026-09-26T09:16:56.491136Z"}, {"uuid": "fccc6746-ac55-478c-962e-bd4dd60a0308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwgppzikrs2h", "content": "Attackers Target Unpatched Roundcube Servers With CVE-2026-48842 https://redoracle.com/News/attackers-target-unpatched-roundcube-servers-with-cve-2026-48842.html #roundcube #servers #2026", "creation_timestamp": "2026-09-26T16:35:33.960213Z"}, {"uuid": "7485cba8-7fe7-436f-b41c-38fca23e55d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3305", "content": "\ud83d\udd34 Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nThreat actors have been exploiting a high-severity vulnerability in Roundcube, the popular open source webmail client, the Canadian Centre for Cyber Security warns.\n\nTracked as CVE-2026-48842 (CVSS score of 8.1), the security defect is described as an SQL injection in the virtuser_query plugin that can be exploited without authentication.\n\nThe plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.", "creation_timestamp": "2026-09-25T15:06:01.000000Z"}, {"uuid": "6d0c2f14-72f2-43b0-90c8-486e4bbdd4db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103527", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 11:35:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48842 PoC \u2014 Roundcube virtuser_query pre-auth SQLi\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T12:00:07.000000Z"}, {"uuid": "c2ecbfe1-ed6e-46ff-85f4-746c50d9780b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwkonmkl3227", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild\n\nsecurityaffairs.com/199882/secur...\n\n#Cybersecurity #LargeScaleImpact #Vulnerability", "creation_timestamp": "2026-09-28T06:26:59.406408Z"}, {"uuid": "39277261-6454-4b04-8e2c-280053937c5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48842", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwkhsigmsr26", "content": "\ud83d\udcf0 Celah Kritis Roundcube Kini Aktif Dieksploitasi untuk Serangan Code Injection\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/celah-kritis-roundcube-cve-2026-48842/\n\n#cpanel #cve #cybersecurity #emailSecurity #exploit #keamananSiber #roundcube #serverSecurity #sqlInjection ", "creation_timestamp": "2026-09-28T04:24:26.991880Z"}, {"uuid": "1aac5053-aeb7-423d-acac-67262de26794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c221e691-543f1996ee93e00f", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of database compromise. A Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVSS score of 8.1) and patched four months ago, is now being exploited in the wild. The Canadian Centre for Cyber Security added the warning to its advisory [\u2026]Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild", "creation_timestamp": "2026-09-28T06:27:32.618766Z"}, {"uuid": "6c369f0e-cfa6-49e5-b38e-d9dd2280237c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwkooptoyts2", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of database compromise. A Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVSS score of 8.1) and patched four months ago, is now being exploited in the wild. The [\u2026]", "creation_timestamp": "2026-09-28T06:27:40.484622Z"}, {"uuid": "b218e79c-24eb-4f43-9da7-2e1c69dd0a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/yasna.io/post/3mwkotqaryh2w", "content": "A critical Roundcube Webmail SQL injection flaw (CVE-2026-48842) is actively exploited, risking unpatched servers with database compromise and code injection attacks.\n\n#infosec\n\nFull synthesis & sources: yasna.io", "creation_timestamp": "2026-09-28T06:30:23.773423Z"}, {"uuid": "bb83bef1-5935-4dbb-9846-c97294508138", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "Telegram/OGevTEe2rJBIfg8PPIQDkdK2Okl9LLTB8hw7xg5ck0cIUKOg", "content": "", "creation_timestamp": "2026-09-28T06:40:05.000000Z"}, {"uuid": "d629a3b5-d738-4455-8f55-5c0df43619e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/ctinow/257490", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild\nhttps://ift.tt/domk749", "creation_timestamp": "2026-09-28T06:29:34.000000Z"}, {"uuid": "ab07aed4-f4bf-4092-a4ad-8ddf70eccb68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3329", "content": "\ud83d\udd34 Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild\n\nA Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVSS score of 8.1) and patched four months ago, is now being exploited in the wild. The Canadian Centre for Cyber Security added the warning to its advisory on September 21, citing open-source reporting and urging administrators to apply the available updates.\n\nThe vulnerability CVE-2026-48842 affects Roundcube 1.6.x versions before 1.6.16 and 1.7.x versions before 1.7.1, but there\u2019s an important detail: the vulnerable code sits in the virtuser_query plugin.", "creation_timestamp": "2026-09-28T12:31:06.000000Z"}, {"uuid": "b9a17ef0-0b25-46aa-bc87-72454d2d41cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/sleepydogtsjp.bsky.social/post/3mwmh523xm22u", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild: securityaffairs.com/199882/secur...", "creation_timestamp": "2026-09-28T23:17:48.394924Z"}, {"uuid": "2bdf5e0f-0498-4d37-91c0-d4dd19dd5734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwmlsctkj22d", "content": "Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild\n\nRoundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of database compromise. A Roundcube Webmail vulnerability, tracked as CVE-2026-48842 (CVS\u2026\n#hackernews #news", "creation_timestamp": "2026-09-29T00:41:15.032482Z"}, {"uuid": "87ffb0ff-72fc-427e-aa88-e9fd562f8a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/WkCWq67CgLBcm_hEcvrpJWcHwwDb7nvZdSlCBdaLX915QMo", "content": "", "creation_timestamp": "2026-09-27T15:00:39.000000Z"}, {"uuid": "be3eaf49-dc50-4764-8085-48f51c3ae354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "0ad3b62a-2465-435d-b5b2-68b57011e938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnduq5kp227", "content": "\ud83d\udfe0 Roundcube CVE-2026-48842 \u2014 pre-auth SQL injection\nA CVSS 8.1 flaw in the virtuser_query plugin can expose vulnerable Roundcube installations before authentication. Exploitation has been reported, but i\nstemshop.top/blog/roundcu...\n#CVE #CVE202648842 #Roundcube #Webmail #SQLInjection #CyberSecurity", "creation_timestamp": "2026-09-29T07:52:09.066250Z"}, {"uuid": "4032d33b-3c28-4c58-b880-02834ecbf90b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/WkCWq67CgLBcm_hEcvrpJWcHwwDb7nvZdSlCBdaLX915QMo", "content": "", "creation_timestamp": "2026-09-27T15:00:39.000000Z"}, {"uuid": "ab9b278d-fb67-4c35-aa78-7b85948965ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "content": "", "creation_timestamp": "2026-09-27T21:00:04.000000Z"}, {"uuid": "125ba72f-8c2c-4fde-9535-6b032a328e0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/bdufstecru/3489", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 preg_replace() \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0430 RoundCube Webmail \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-07447\nCVE-2026-48842\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9\nhttps://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.1\nhttps://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1", "creation_timestamp": "2026-09-30T15:17:47.000000Z"}, {"uuid": "f053f971-513a-406c-ac3c-d0a52d0770fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3489", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 preg_replace() \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0430 RoundCube Webmail \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u0430 SQL. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-07447\nCVE-2026-48842\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/roundcube/roundcubemail/commit/3406183a9976e36f992d3468f37d0e2346526ee9\nhttps://github.com/roundcube/roundcubemail/commit/87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.16\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.1\nhttps://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1", "creation_timestamp": "2026-09-30T15:17:47.000000Z"}, {"uuid": "4c001108-e2a9-4303-a9bd-fc3f33e6a105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/CyberDispatch/3085", "content": "Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.", "creation_timestamp": "2026-09-25T15:56:58.000000Z"}, {"uuid": "2b5e542d-c1fa-4d7b-86d5-5afb11e21b29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/CyberDispatch/3085", "content": "Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May.\n\nCVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin.", "creation_timestamp": "2026-09-25T15:56:58.000000Z"}, {"uuid": "f3060514-66df-4021-a0f4-07766463f3ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "https://t.me/GithubRedTeam/104157", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XsanFlip\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 10:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48842 Roundcube SQLi Verifier\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-03T10:04:32.000000Z"}, {"uuid": "66ef654a-6c0b-44bf-8529-1b1ed8421ec4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104157", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-48842\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XsanFlip\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 10:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-48842 Roundcube SQLi Verifier\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-03T10:04:32.000000Z"}, {"uuid": "a7df6476-7cae-4b3b-a4fb-69bfe4aea58e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/rmqy4r2ZbbSgIUkJCd_XbrHKxpruNJNPs_qt3HHt61i6SNQ", "content": "", "creation_timestamp": "2026-10-03T15:00:20.000000Z"}, {"uuid": "8f23af2d-ff72-41ee-9fda-bb754a718f10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "seen", "source": "Telegram/ELm8PgQpllbXA_VH21iOqLKTsdjbs5AcKNDqc-vEf4a8Tt0", "content": "", "creation_timestamp": "2026-10-03T21:00:05.000000Z"}, {"uuid": "45d0d211-6dd1-4dba-bfdb-7ae32bacab2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/ELm8PgQpllbXA_VH21iOqLKTsdjbs5AcKNDqc-vEf4a8Tt0", "content": "", "creation_timestamp": "2026-10-03T21:00:05.000000Z"}, {"uuid": "01b3f96a-e9c6-44f4-92a5-1973068d32c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "published-proof-of-concept", "source": "Telegram/rmqy4r2ZbbSgIUkJCd_XbrHKxpruNJNPs_qt3HHt61i6SNQ", "content": "", "creation_timestamp": "2026-10-03T15:00:20.000000Z"}]}