The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6391 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6391-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 19, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : roundcube     CVE ID         : CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-62642                      CVE-2026-62643 CVE-2026-62644     Debian Bug     : 1141495

    Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX     based webmail solution for IMAP servers, which could result in account     takeover, cross-site scripting, SSRF bypass, information disclosure or     denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 1.6.17+dfsg-0+deb13u1.

    We recommend that you upgrade your roundcube packages.

    For the detailed security status of roundcube please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/roundcube

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-6391 : roundcube - security update

critical Nessus Plugin ID 327907

Version 1.2

Version 1.1

Version 1.2 Jul 21, 2026, 8:31 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2026-54433" to "CVE-2026-62644") CVSSv3 score source (set to "CVE-2026-62643") Plugin Feed: 202607212031
Version 1.1 Jul 20, 2026, 7:40 PM New Plugin Feed: 202607201940