Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
{ "urgency": "low" }