{"metadata": {"vulnerability": "CVE-2026-114727", "count": 13, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-22T01:59:00.397Z", "date_only": false, "value": "2026-10-22T01:59:00.397Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114727", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T01:59:00.789Z", "date_only": false, "value": "2026-10-22T01:59:00.789Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114727", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-22T01:59:00.789Z", "date_only": false, "value": "2026-10-22T01:59:00.789Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114727", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-22T01:59:00.789Z", "date_only": false, "value": "2026-10-22T01:59:00.789Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-114727", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T02:17:00Z", "date_only": false, "value": "2026-10-22T02:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J8WG-2Q5H-M4XQ", "record": "GHSA-J8WG-2Q5H-M4XQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-22T02:17:00.797Z", "date_only": false, "value": "2026-10-22T02:17:00.797", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114727", "record": "FKIE_CVE-2026-114727", "field": "published"}, {"timestamp": "2026-10-22T02:48:53.787Z", "date_only": false, "value": "2026-10-22T02:48:53.787458Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117482280276382189", "record": "CVE-2026-114727", "field": "creation_timestamp", "uuid": "b80ad3cb-08e2-412d-abd1-e1b6fb4e0fe2", "content": "CVE-2026-114727  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit \u201cFix passing potentally unsafe attachment content into ImageMagick on image resize\u201d, which removes svg and eps from the accepted types.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114727https://bugs.debian.org/1151279https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5https://github.com/roundcube/roundcubemail/releases/tag/1.7.5https://github.com/roundcube/roundcubemail/releases/tag/1.6.20https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665#roundcube #Roundcube #Webmail#CVE_2026_114727#bot", "url": "https://infosec.exchange/users/cve/statuses/117482280276382189"}, {"timestamp": "2026-10-22T03:33:37Z", "date_only": false, "value": "2026-10-22T03:33:37Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J8WG-2Q5H-M4XQ", "record": "GHSA-J8WG-2Q5H-M4XQ", "field": "published"}, {"timestamp": "2026-10-22T03:33:37Z", "date_only": false, "value": "2026-10-22T03:33:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J8WG-2Q5H-M4XQ", "record": "GHSA-J8WG-2Q5H-M4XQ", "field": "modified"}, {"timestamp": "2026-10-22T04:30:24.251Z", "date_only": false, "value": "2026-10-22T04:30:24.251845Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117482679404111487", "record": "cve-2026-114727", "field": "creation_timestamp", "uuid": "4ed4b8f2-91f4-404e-b949-53e8392f11bb", "content": "CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-114727-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-roundcube-webmail-0e067a7fe4b46d68 #OffSeq #Vulnerability #Infosec #Roundcube", "url": "https://infosec.exchange/users/offseq/statuses/117482679404111487"}, {"timestamp": "2026-10-22T16:45:49.550Z", "date_only": false, "value": "2026-10-22T16:45:49.550", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114727", "record": "FKIE_CVE-2026-114727", "field": "lastModified"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114727", "record": "UBUNTU-CVE-2026-114727", "field": "published"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114727", "record": "UBUNTU-CVE-2026-114727", "field": "modified"}]}