Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
1. Executive summary CVE-2026-48842 is a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail, affecting 1.6.x before 1.
25 Sep 2026 · 6 min read
read →