Facebook failed to fully sanitize error data returned by a public facing web app.

Open source webmail provider Roundcube was patched against a vulnerability that could be trivially exploited to run code on servers or access email accounts.