The WASI preview 0 implementation of poll_oneoff in Wasmtime's wasmtime-wasi crate performs host work proportional to the number of subscriptions supplied without consuming or checking fuel, so a malicious guest module can submit a large subscription list and force long-running host computation that ignores configured fuel limits. Affected releases are those before 36.0.17, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1; the wasmtime CLI is exposed by default because preview 0 is enabled there, while library embeddings are affected only when they explicitly add the p0 adapter through p0::add_to_linker_async or p0::add_to_linker_sync. Exploitation requires running an attacker-controlled guest, WASIp1, WASIp2 and WASIp3 are unaffected, and no public exploit identified at time of analysis; vendor patches are published as 36.0.17, 48.0.4 and 49.0.2.
HTML injection in the conversational notification header of Vikunja 2.2.0 through 2.7.0 allows an authenticated project member to break out of the display anchor and plant a clickable phishing link in task-comment and task-mention emails that Vikunja sends to other project members. The attacker only needs control of text that reaches the header - a task title, a project title or their own display name - plus shared project membership and an action that triggers a notification (an @mention or an assignment). Impact is confined to link injection in the rendered email: no script execution is possible, remote images are neutralized by the sanitizer, and the recipient must click the injected link in an HTML-capable mail client, so the practical effect is credential-phishing redirection rather than code execution or data compromise. No CISA KEV entry, no confirmed public exploit code and no EPSS signal are present in the supplied data; the vendor advisory does include a detailed end-to-end lab reproduction using the REST API and a local SMTP sink.
Out-of-bounds reads in Silicon Labs Z-Wave SDK 8.1.1 and earlier allow an attacker with board-level access to the NCP SPI bus to leak sensitive memory contents from the device, rated CVSS 4.0 5.1. The flaw is not reachable over the Z-Wave RF mesh or any IP network: the assessed vector (AV:P/AC:L/PR:N/UI:N, C:H/I:N/A:N) requires physically attaching to the serial SPI interface between the host MCU and the Z-Wave radio and issuing a malformed command, which makes it a moderate, access-gated disclosure risk rather than a remotely exploitable emergency. No public exploit code has been identified at time of analysis, and no CISA KEV entry is associated with this issue; priority is tracked as remediation within the current month.
Mail header injection in Roundcube Webmail (all versions before 1.6.20 and 1.7.x before 1.7.5) lets a logged-in webmail user smuggle arbitrary headers into an outgoing message by placing CRLF sequences in the References, In-Reply-To, Message-ID, or From request parameters processed by rcmail_sendmail. The primary limiting factor is authentication (CVSS PR:L): only account holders, compromised accounts, or self-service/guest registrations can reach the compose-and-send flow, and the assessed impact is integrity-only with a scope change rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is a moderate-priority correctness fix rather than a top-tier emergency; vendor patches exist in 1.6.20 and 1.7.5.
High-privilege authenticated users can trigger an availability-only denial-of-service condition in HPE networking products over the network with low complexity and no user interaction, reflected by CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). The affected models, firmware branches, and specific trigger are not identified in the provided data. No public exploit was identified at time of analysis, and the high-privilege prerequisite limits practical exposure to trusted or already-compromised administrative accounts.
Stored cross-site scripting in WordPress Core through 7.0.2 lets an authenticated user with Contributor-level access or higher save a malicious display name that is insufficiently escaped when rendered in the Quick Edit interface, so the script fires when an Editor or Administrator later opens the affected administrative screen. The vendor explicitly limits real-world exposure to installations with a large number of users, which is reflected in the high attack-complexity rating and confines meaningful risk to large multi-author, membership, or open-registration sites. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is remediated in WordPress 7.0.3.
Timing side-channel leakage in Drupal's SAML SSO - Service Provider module (reported affected range 0.0.0 through 3.2.0) can give remote attackers a measurable signal that may aid brute-force efforts against values handled by the module. The issue is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), meaning exploitation is unauthenticated but high-complexity with limited confidentiality and integrity impact; EPSS is 0.15% (4th percentile), no KEV designation is present in the supplied intelligence, and no public exploit has been identified at time of analysis. A vendor patch is available through Drupal's advisory.
Improper verification of cryptographic signatures in the Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0) allows a remote attacker to spoof SAML assertions and have them accepted by a site acting as a SAML Service Provider, yielding limited confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) indicates no authentication or user interaction is required but that the attack is complex to carry out; the trigger is not described in the available sources. This is a genuinely moderate, not high-priority, issue: EPSS is 0.10% (1st percentile), there is no CISA KEV entry, no public exploit identified at time of analysis, and a vendor patch is available, giving a 'this_month' priority.
The Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0) fails to properly validate the certificate presented on the connection between the Service Provider and its SAML Identity Provider, allowing an attacker who already holds an adversary-in-the-middle position on that path to intercept or alter the SAML exchange (CWE-295). Impact is bounded: confidentiality and integrity are partially affected while availability is not, giving a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N); the high attack complexity reflects the MITM precondition rather than any authentication barrier, since exploitation is unauthenticated once that foothold exists. No public exploit code was identified at time of analysis and the module is not in CISA KEV; EPSS is 0.10% (1st percentile), so this is a genuine but low-urgency patching item rather than an emergency.
Improper certificate validation in the Drupal Cloud module (versions 0.0.0 through 7.0.1, fixed in 7.0.1) lets an attacker who already occupies an adversary-in-the-middle position on the network path have a forged or untrusted certificate accepted, yielding limited confidentiality and integrity impact without authentication or user interaction (CVSS 4.8, AC:H, PR:N, UI:N). The MitM prerequisite is the main limiting factor: an off-path remote attacker cannot trigger the flaw. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.09% (percentile 0%), so it is rated a moderate-severity, lower-priority item scheduled for this month.
Cross-site scripting in the optional password plugin of Roundcube Webmail (before 1.6.20, and 1.7.x before 1.7.5) allows a hostile or compromised password backend - the advisory names the DirectAdmin API - to inject script into the webmail interface by returning crafted error text during a password-change attempt. The driver's message was concatenated into the user-facing error string without HTML escaping, so the payload executes in the victim's Roundcube session and can read or act on mail content within that origin (scope change). Exploitation requires the password plugin to be enabled and a victim to actually submit a password change (UI:R), which limits mass abuse; the CVSS vector rates it 4.7 with PR:N but high attack complexity, and no public exploit code or CISA KEV listing was identified at time of analysis. Vendor-released patches exist in 1.6.20 and 1.7.5.
Cross-site scripting in the Drupal Webform contributed module allows an authenticated low-privileged user to inject script that runs when another user interacts with the generated page, affecting Webform releases below 6.2.12 in the 6.2.x branch and below 6.3.1 in the 6.3.x branch. The provided data shows no public exploit identified at time of analysis, EPSS at 0.21% (10th percentile), and no confirmed CISA KEV listing; exploitation requires a victim to interact with the malicious page.
Cross-site scripting in the Drupal Webform contributed module lets an authenticated low-privilege user supply input that Webform renders into a generated page without neutralization, so the payload executes in the browser of any user who later loads that page, scoped to the victim's own session (CVSS 3.1 base 4.6, S:U, C:L/I:L/A:N). Drupal sites running Webform before 6.2.12, or 6.3.0 before 6.3.1, are affected; exploitation requires a low-privileged account (PR:L) plus victim interaction (UI:R), which are the principal limiters on real-world exploitability. EPSS is 0.20% (10th percentile), no public exploit identified at time of analysis, no CISA KEV entry, and a vendor patch is available, so the vuln.today decision label is this_month.
Stored cross-site scripting in the Drupal Webform contrib module (versions 0.0.0 through 6.2.11 and 6.3.0) lets a low-privilege authenticated user inject HTML that Drupal Webform later renders without neutralization. The payload only executes when a separate victim loads the affected page, so impact is limited to the victim's browser session with unchanged scope and no availability effect; CVSS is 4.6 and EPSS is low at 0.20% (10th percentile). No public exploit code or active exploitation is confirmed, and vendor patches are available in 6.2.12 and 6.3.1.
Stored cross-site scripting in the Drupal Webform contributed module lets an authenticated user who holds Webform authoring privileges (creating or editing webforms, elements, or related configuration) embed a persistent script payload that executes when a higher-trust user, such as a site administrator, views the affected page. The flaw is a CWE-267 privilege-definition problem: a role is permitted an unsafe action it should not be, and exploitation additionally requires victim user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), with impact limited to Low confidentiality and integrity and no availability effect. Affected releases are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and the vendor has released a patch, so this rates as a moderate-priority issue rather than an emergency.
Cross-site scripting in Drupal Webform allows a low-privileged authenticated user to place unneutralized input that executes in another user's browser when the affected content is rendered. The published affected ranges cover Webform 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1, with CVSS 4.6 (PR:L/UI:R) limiting impact to the victim's browser context; 6.2.12 and 6.3.1+ are treated as not affected in the independent assessment, so the boundary should be confirmed against the vendor advisory. No public exploit is identified at time of analysis, EPSS is 0.17%, CISA KEV does not list it, and the priority is moderate rather than emergency.
Stored cross-site scripting in the Drupal contributed Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) allows an authenticated user who can submit or configure webform content to persist malicious markup that executes in the browser of another user who later views it. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), exploitation needs a low-privileged Drupal account plus a victim - typically an administrator or form reviewer - opening the stored content, so impact is limited to the victim's session context in the affected site. Severity is medium (vendor CVSS 4.6), EPSS is 0.17% (6th percentile), no public exploit was identified at time of analysis, and a vendor patch is available per Drupal security advisory SA-CONTRIB-2026-172, placing remediation in a this-month window rather than an emergency response.
Stored cross-site scripting in the Drupal contributed 'Component blocks' module (versions 0.0.0 through 1.2.6) lets an authenticated user who holds permission to create or edit component blocks persist malicious script that executes in the browser of any user viewing the poisoned block, including administrators. Rated CVSS 4.6 with a PR:L/UI:R profile, so exploitation needs both a block-authoring account and a victim who loads the rendered content; Drupal core and sites without the module are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-to-moderate real-world priority and a 'this month' patch cadence rather than an emergency.
Stored cross-site scripting in the Drupal contributed module PhotoSwipe - Responsive JavaScript Modal Image Gallery (versions below 5.0.9) lets a user who can create or edit content handled by the module persist an unsanitized payload that executes in the browser of another user who later views the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6) confirms an authenticated content contributor is required and that a second user must interact with the page, with impact limited to partial confidentiality and integrity inside the victim's session and no availability effect. No public exploit code is identified at time of analysis and CISA SSVC records exploitation as none and not automatable, with EPSS at 0.16% (5th percentile); the vendor has released a fix in 5.0.9, so exposure is removed by updating.
Stored cross-site scripting in the Drupal SafeDelete contributed module (versions 0.0.0 through 1.0.88) allows a low-privileged authenticated user to persist malicious markup that executes in the browser of a second user - typically an administrator or content reviewer - who later loads the page where the unneutralized input is rendered. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) rates this 4.6, a moderate severity: exploitation requires an authenticated account able to write into the affected SafeDelete field plus victim interaction, which meaningfully lowers real-world risk below what the network vector alone suggests. No public exploit code has been identified at time of analysis and EPSS is 0.16% (5th percentile); the vendor has published a security advisory and a fix is available.
Authlib's OpenID Connect implicit grant (OpenIDImplicitGrant) before 1.9.0 validates the openid scope against the raw, client-supplied request.payload.scope instead of the client-filtered request.scope, so a registered client that is permitted an id_token response type but is explicitly denied the openid scope can still obtain a signed ID token. The attacker must already be a registered client (PR:L) and a user must log in and consent (UI:R); the resulting token carries the user's subject and allowed profile claims but its audience is the attacking client, giving limited confidentiality impact. Deployments using only the OIDC authorization-code flow, or where every client permitted an id_token response type is also allowed openid, are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal is a measured this-month fix rather than an emergency.
Stored cross-site scripting in the Drupal contributed module Diba carousel slider (versions 0.0.0 through 3.0.2) allows an authenticated user who can create or edit content rendered by the module to persist a script payload that executes in the browser of another user who views the affected page. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), the attacker must already hold content-authoring privileges and a separate victim must interact with the page, and the resulting impact is limited to the victim's browser session with no availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix; the priority signal places remediation in the current monthly maintenance cycle rather than an emergency response.
The Drupal AI (Artificial Intelligence) contrib module performs insufficient authorization checks on at least one of its endpoints, allowing forceful browsing - an authenticated user can reach a resource or route directly by URL that the module never gates behind an access check. Versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8 are affected; exploitation requires a valid account with at least low privileges (PR:L) and cannot be performed anonymously, with impact limited to partial confidentiality and integrity and no availability effect (CVSS 4.6). There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has published a security advisory with a fix.
Missing authorization in the Drupal AI Translate contrib module allows forceful browsing, so a user who already holds a low-privilege authenticated account on an affected site can reach AI Translate functionality or resources that should be gated behind stricter permissions. The issue affects the 0.0.0 through 1.3.2 and 1.4.0 through 1.4.1 version ranges and is rated moderate (CVSS 4.6, low confidentiality and integrity impact, no availability impact); only Drupal sites with this contrib module installed are exposed. Vendor patches are available at 1.3.2 and 1.4.1 per the Drupal advisory, no public exploit code has been identified at time of analysis, and the prioritisation signal places it in the this-month remediation window rather than an emergency one.
An availability-focused flaw in an unspecified HPE product can be triggered by an attacker who already holds high local privileges, causing a high availability impact (CVSS:3.1 base score 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Confidentiality and integrity are unaffected, and because both local access and pre-existing high privilege are required, remote or unprivileged actors cannot reach the issue. No public exploit code has been identified at time of analysis, and the issue carries a this_month priority rather than an emergency rating.
Object injection in Drupal Commerce Decoupled Checkout before 1.8.0 can let remote, unauthenticated attackers manipulate dynamically determined object attributes when a victim interacts with the crafted request, with impact limited to integrity. The vendor has released 1.8.0 as the fix. No public exploit was identified at time of analysis, and EPSS is 0.42% (35th percentile).
An unauthenticated information-disclosure flaw exists in SKYWORTH's SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) firmware V1.0.3, exposed through the hidden_factory_switch.gch endpoint. Attackers who are already on the router's adjacent network segment (its own Wi-Fi or wired LAN) can send a crafted HTTP request without credentials or user interaction to retrieve sensitive information; the device is not described as reachable from the internet. Impact is limited to confidentiality (CVSS 4.3, AV:A/AC:L/PR:N/UI:N/C:L/I:N/A:N), EPSS is 0.26% (17th percentile), no CISA KEV entry exists, and the available sources do not confirm working exploit code - the referenced GitHub repository is an unverified public PoC reference. Overall this is a low-to-moderate priority item rather than an emergency.
An incorrect authorization check in the Drupal Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an authenticated low-privilege user reach a Webform resource by requesting its URL directly, bypassing intended access control and exposing limited confidential data. Only sites running the vulnerable module are affected; the CVSS score is 4.3 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the vendor has released fixed versions. This is a moderate-severity information-exposure issue, not an emergency.
PowerPack Addons for Elementor through 3.1.0 lets authenticated low-privilege users bypass access controls and read limited protected data because a plugin action lacks a capability check. The medium-severity CVSS 4.3 flaw requires a valid account (PR:L) and yields only confidentiality impact; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization (CWE-862) in the WP Chill Strong Testimonials WordPress plugin, affecting versions through 3.3.14, lets a holder of a low-privilege authenticated account invoke a plugin action that never verifies the caller's capabilities, so they can make changes they should not be permitted to make. Because the CVSS vector is PR:L with impact limited to integrity (C:N/I:L/A:N), the practical exposure is unauthorized modification of testimonial-related content rather than data theft or site takedown, and the prerequisite is an existing account on the target site. Rated 4.3 by the vendor/Patchstack, with no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Authenticated low-privileged users can read restricted taxonomy term glossary content on Drupal sites running the Taxonomy Term Glossary contrib module before 4.6.0, because directly requested glossary resources lack authorization checks. The issue is CWE-862 missing authorization, rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation needs a valid account and affects confidentiality only. EPSS is 0.15% (4th percentile); no public exploit identified at time of analysis, no CISA KEV entry is indicated, and a vendor patch is available.
A missing authorization check (CWE-862) in the Drupal contributed module Ultimate Table Field lets authenticated users bypass intended access control and reach functionality or data they should not be permitted to access, a pattern Drupal classifies as forceful browsing. Versions 0.0.0 through 1.1.1 and 2.0.0 through 2.0.1 are affected; exploitation requires a valid low-privilege session (CVSS PR:L) on a site with the module installed, with network reachability and low attack complexity but impact limited to low-magnitude integrity effects. No public exploit code and no confirmed active exploitation are indicated, EPSS is low at roughly 0.15% (4th percentile), and the vendor has released a fix.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Improper handling of null elements during playbook import can crash the Mattermost Playbooks plugin instance-wide for authenticated users. Mattermost 11.7.x through 11.7.11 are affected when the Playbooks feature is in use; an attacker with a valid account and the ability to submit an import request can cause a denial of service limited to the Playbooks plugin, with no data exposure. No public exploit identified at time of analysis, and this is a low-to-moderate priority availability issue rather than an emergency; the vendor advisory is MMSA-2026-00709.
Authlib's OpenID Connect client integrations accept an ID token that disables its own nonce check: OpenIDMixin.parse_id_token() reads the nonce_supported claim from the untrusted token payload and, when it is the JSON boolean false, sets the expected nonce to None so both the nonce presence and equality checks are skipped. This lets an attacker who holds a captured, validly signed victim ID token that itself carries nonce_supported:false replay it into an attacker-controlled session and be authenticated as the victim at the relying party; only implicit/hybrid-flow relying parties or applications calling parse_id_token() directly on externally supplied tokens are exposed, while plain authorization code flow is unaffected because the ID token is fetched over TLS after a state lookup. The vendor rates it moderate (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, 6.8); exploitation is unauthenticated from the attacker's side but requires user interaction and is gated by the strong precondition that the captured token was originally issued with a literal boolean nonce_supported:false claim, which the attacker cannot add without breaking the signature. The upstream security advisory includes a proof-of-concept script reproducing acceptance of a mismatched nonce on 1.8.0, and no public exploitation activity is indicated.
Cross-site scripting in the Drupal Webform contrib module allows injected markup to execute in a victim's browser session when a crafted form or submission view is loaded, with impact bounded to low confidentiality and low integrity and no availability effect. Sites running Webform releases from 0.0.0 through 6.2.12 or from 6.3.0 through 6.3.1 are affected; deployments already on a fixed release are not exposed. Exploitation requires victim interaction and the vendor vector rates attack complexity high, no public exploit has been identified at time of analysis, EPSS is only 0.17% (5th percentile), and CISA KEV does not list the issue; a vendor patch is available and the aggregate priority is this_month rather than act-now.
Stored cross-site scripting in the Drupal Feed Block contrib module (versions before 2.0.2 on the 2.x line and before 3.0.2 on the 3.x line) allows an authenticated user who can supply or configure content rendered by the block to persist a script payload that executes in another user's browser when the affected block is rendered on a page. Impact is bounded to low confidentiality and low integrity in the victim's browser context, with no availability impact, and only sites running the Feed Block module are affected - sites without it are not exposed. Vendor patches are available (2.0.2 and 3.0.2), EPSS is very low at 0.16% (5th percentile), and no public exploit has been identified at time of analysis; this is a low-to-moderate priority, scheduled-patching item rather than an emergency.
Drupal Advanced Search 0.0.0 through 2.4.5 fails to enforce an authorization check on a search-related resource, allowing remote clients to use forceful browsing and obtain limited confidentiality and integrity impact without affecting availability. The vendor-assigned CVSS 3.1 score is 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), and exposure requires the contrib module to be installed and enabled. A vendor patch is available and no public exploit identified at time of analysis.
Cross-site request forgery in the Drupal Project Browser contributed module (affected ranges 0.0.0 through 2.0.2 and 2.1.0 through 2.1.4) lets an attacker riding an already-authenticated administrator's browser session submit forged requests against the site, with low confidentiality and integrity impact. Exploitation depends on luring a logged-in victim into interacting with attacker-controlled content while the session is live, so the vendor-assessed vector is AV:N/AC:H/PR:N/UI:R with a 4.2 base score, and EPSS is only 0.10% (1st percentile). There is no CISA KEV entry and no public exploit identified at time of analysis; vendor-released fixes exist in Project Browser 2.0.3 and 2.1.5, making this a low-to-moderate priority item to fold into the normal monthly patch cycle rather than an emergency.
Mail header injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote attacker inject arbitrary MIME part headers into an outgoing message when a victim forwards a crafted email as an attachment, because the received subject is reused verbatim as the generated attachment name without neutralizing CRLF sequences. Exploitation is not automatic: it requires the victim to receive the crafted message and then invoke the 'forward as attachment' compose action, and the assessed impact is limited to low integrity with no confidentiality or availability loss and no code execution (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N). Fixes are available in Roundcube 1.6.20 and 1.7.5; no public exploit was identified at time of analysis.