Skip to content
pwned.coffee
Updated 30 min ago
Today's specials
Specials
13
Past orders
Past
The menu
Menu
Your usual
Usual
Delivery
Delivery
History
20 Feb 2026
1 new, 0 updated.
New that day
high
patched
exploited
20 Feb 2026
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Can be chained with CVE-2025-68461. Added to CISA KEV on 2026-02-20 (federal deadline 2026-03-13).
CVE-2025-49113
CVE-2025-68461
7 sources