InfoSecBulletin Cybersecurity for mankind
Zimbra has launched updates to fix serious security flaws, including a command injection bug in the SNMP monitoring part. As many as nine security flaws have been fixed in Zimbra 10.1.20. The biggest issue is a command injection problem in the SNMP monitoring part when SNMP alerts are turned on.
Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client:
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
An XSS vulnerability where a crafted field could execute a malicious script when rendered.
An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Fixes have come out for a flaw that lets users get around mail forwarding limits (CVE-2026-50055). This could let logged-in users steal emails even when mail forwarding is turned on. Jonah Burgess from Rapid7 found and reported this issue.
The company did not share any additional specifics, stating “in line with industry best practices, information disclosure is limited for security vulnerability fixes.”
The release comes a little over a week after Zimbra fixed a serious stored XSS problem in the Classic Web Client that could let attackers run any code.
None of the known problems have been marked as used right now, but bad people have often used XSS bugs in the email software before. It is very important for customers to install the updates to stay safe.
