Get an email when a new major security incident drops. No spam, unsubscribe any time.
Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.
// day
1 new incident, 0 with updates.
› Roundcube Webmail
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113, CVE-2025-68461 to the Known Exploited Vulnerabilities catalog on 2026-02-20 based on evidence of active exploitation.
