InfoSecBulletin Cybersecurity for mankind
Zimbra has launched updates to fix serious security flaws, including a command injection bug in the SNMP monitoring part. As many as nine security flaws have been fixed in Zimbra 10.1.20. The biggest issue is a command injection problem in the SNMP monitoring part when SNMP alerts are turned on.
Also patched are four cross-site scripting (XSS) flaws in the Classic Web Client:
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
A stored cross-site scripting (XSS) vulnerability that could allow malicious attachment filenames to execute script under specific conditions.
An XSS vulnerability where crafted fields could execute a malicious script under specific conditions.
An XSS vulnerability where a crafted field could execute a malicious script when rendered.
An XSS vulnerability where crafted attachments could execute a malicious script when rendered.
Fixes have come out for a flaw that lets users get around mail forwarding limits (CVE-2026-50055). This could let logged-in users steal emails even when mail forwarding is turned on. Jonah Burgess from Rapid7 found and reported this issue.
The company did not share any additional specifics, stating “in line with industry best practices, information disclosure is limited for security vulnerability fixes.”
The release comes a little over a week after Zimbra fixed a serious stored XSS problem in the Classic Web Client that could let attackers run any code.
None of the known problems have been marked as used right now, but bad people have often used XSS bugs in the email software before. It is very important for customers to install the updates to stay safe.
