Jun 9, 2025
1 new incident, 1 with updates.
Started
- ClosedPatched
Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Added to CISA KEV on 2025-06-09.
Roundcube WebmailClosed Jun 9, 2025
Updated
- ClosedPatched
Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)
The Erlang/OTP SSH server processed connection-protocol messages before authentication, so anyone who could reach the port could run commands. It affects any product embedding the OTP SSH daemon. Fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20; CISA confirmed exploitation in June.
Erlang/OTP SSHClosed Jun 9, 2025
