CVE-2026-65053 is a stored cross-site scripting (XSS) vulnerability in Horde IMP's AppleDouble MIME viewer. An attacker can send a crafted multipart/appledouble message with markup in the data part's name parameter, which will be executed in the context of any user who views it. The payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a u [truncated]
CVE-2026-60102 is an OS command injection vulnerability in the Horde_Vfs_Smb driver of Horde Virtual File System (VFS) API before version 3.0.1. The vulnerability occurs because the _escapeShellCommand() method fails to sanitize command substitution sequences. This allows authenticated attackers to inject arbitrary shell commands through user-controlled filenames. The commands are executed via proc_open() [truncated]
