cve.bz

roundcube webmail vulnerabilities in 2026, newest first, page 2

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 6.5CVE-2026-35540EPSS 0.4%

    An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network h…

  2. 6.1CVE-2026-35539EPSS 0.3%

    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

  3. 3.1CVE-2026-35538EPSS 0.4%

    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

  4. 7.5CVE-2026-35537EPSS 0.5%

    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

  5. 4.7CVE-2026-26079EPSS 0.4%

    Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

  6. 4.3CVE-2026-25916EPSS 0.8%

    Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.