{"items":[{"id":"CVE-2026-114732","published":"2026-10-22T02:16:51.833Z","updated":"2026-10-29T10:57:39.353Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in…","severity":"MEDIUM","score":6.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00384,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114731","published":"2026-10-22T02:12:34.577Z","updated":"2026-11-02T15:58:52.667Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00432,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114730","published":"2026-10-22T02:09:40.059Z","updated":"2026-10-28T02:18:48.643Z","title":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00373,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114729","published":"2026-10-22T02:05:39.669Z","updated":"2026-10-26T19:39:00.590Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00376,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114728","published":"2026-10-22T02:02:49.325Z","updated":"2026-10-26T16:46:46.332Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114727","published":"2026-10-22T01:59:00.789Z","updated":"2026-11-02T15:57:00.068Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as…","severity":"HIGH","score":8.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00327,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114726","published":"2026-10-22T01:55:25.693Z","updated":"2026-10-28T02:17:15.141Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action.…","severity":"MEDIUM","score":5.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00397,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114725","published":"2026-10-22T01:52:10.894Z","updated":"2026-10-26T19:39:17.780Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only…","severity":"MEDIUM","score":5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00329,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114724","published":"2026-10-22T01:48:23.338Z","updated":"2026-10-28T19:02:03.045Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!”…","severity":"HIGH","score":7.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00407,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114723","published":"2026-10-22T01:44:01.558Z","updated":"2026-11-02T15:19:13.206Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image…","severity":"LOW","score":3.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00457,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114722","published":"2026-10-22T01:39:43.658Z","updated":"2026-10-28T02:13:07.335Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an…","severity":"MEDIUM","score":6.5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00252,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114721","published":"2026-10-22T01:36:10.621Z","updated":"2026-10-26T19:39:29.151Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action…","severity":"LOW","score":3.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00296,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114720","published":"2026-10-22T01:32:44.426Z","updated":"2026-10-26T16:46:46.479Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this…","severity":"HIGH","score":7.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00794,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114719","published":"2026-10-22T01:28:45.516Z","updated":"2026-11-02T15:54:43.963Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin…","severity":"LOW","score":3.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00216,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114718","published":"2026-10-22T01:24:46.941Z","updated":"2026-10-28T02:12:35.708Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a…","severity":"MEDIUM","score":4.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00293,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114717","published":"2026-10-22T01:21:14.794Z","updated":"2026-10-26T19:39:43.919Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The…","severity":"MEDIUM","score":4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00447,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114716","published":"2026-10-22T01:17:45.277Z","updated":"2026-10-26T16:46:46.624Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the…","severity":"HIGH","score":8.5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114715","published":"2026-10-22T01:13:35.419Z","updated":"2026-11-02T15:01:11.219Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin.…","severity":"MEDIUM","score":6.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00343,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114714","published":"2026-10-22T01:08:34.579Z","updated":"2026-10-28T02:11:26.866Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00367,"kevAdded":null,"exploit":false},{"id":"CVE-2026-113386","published":"2026-10-20T04:53:46.220Z","updated":"2026-10-22T21:17:14.176Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF…","severity":"HIGH","score":7.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.01004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75010","published":"2026-08-17T13:01:26.692Z","updated":"2026-08-17T14:11:00.263Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a…","severity":"MEDIUM","score":6.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00285,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75007","published":"2026-08-17T12:58:48.792Z","updated":"2026-08-18T03:55:32.206Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead…","severity":"MEDIUM","score":5.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00353,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75006","published":"2026-08-17T12:56:47.427Z","updated":"2026-08-17T14:06:46.947Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or…","severity":"MEDIUM","score":5.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00416,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75004","published":"2026-08-17T12:53:50.097Z","updated":"2026-08-17T14:37:04.784Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted…","severity":"MEDIUM","score":4.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75003","published":"2026-08-17T12:50:51.836Z","updated":"2026-08-18T03:55:30.789Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking,…","severity":"MEDIUM","score":5.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75002","published":"2026-08-17T12:48:41.254Z","updated":"2026-08-18T03:55:29.235Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or…","severity":"HIGH","score":7.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.01356,"kevAdded":null,"exploit":false},{"id":"CVE-2026-75000","published":"2026-08-17T12:45:56.860Z","updated":"2026-08-18T03:55:27.932Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate \"by\" attribute may lead to remote image blocking…","severity":"MEDIUM","score":5.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00346,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74999","published":"2026-08-17T12:42:51.526Z","updated":"2026-08-17T14:33:47.482Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the \"Add to address book\" action was subject to stored XSS.","severity":"MEDIUM","score":5.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.0026,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74998","published":"2026-08-17T12:40:29.903Z","updated":"2026-08-17T16:01:16.269Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00322,"kevAdded":null,"exploit":false},{"id":"CVE-2026-74997","published":"2026-08-17T12:37:45.126Z","updated":"2026-08-17T14:34:26.557Z","title":"In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted…","severity":"HIGH","score":8.8,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00784,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54432","published":"2026-07-14T16:21:55.409Z","updated":"2026-07-15T15:13:14.654Z","title":"Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not…","severity":"MEDIUM","score":4.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00221,"kevAdded":null,"exploit":false},{"id":"CVE-2026-54433","published":"2026-07-14T16:18:16.549Z","updated":"2026-07-15T14:10:33.042Z","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62644","published":"2026-07-14T15:55:22.925Z","updated":"2026-07-14T17:15:20.139Z","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data,…","severity":"MEDIUM","score":6.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00259,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62643","published":"2026-07-14T15:51:46.996Z","updated":"2026-07-14T17:17:16.894Z","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00295,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62642","published":"2026-07-14T15:49:17.798Z","updated":"2026-07-14T17:18:18.192Z","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon…","severity":"MEDIUM","score":4.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-62641","published":"2026-07-14T15:46:29.138Z","updated":"2026-07-14T17:27:50.013Z","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.","severity":"MEDIUM","score":4.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00252,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48849","published":"2026-05-25T19:30:38.414Z","updated":"2026-05-26T13:01:11.210Z","title":"In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS…","severity":"MEDIUM","score":4.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48848","published":"2026-05-25T19:27:54.841Z","updated":"2026-05-26T13:00:52.631Z","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00388,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48847","published":"2026-05-25T19:23:40.853Z","updated":"2026-05-26T13:02:10.123Z","title":"Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.","severity":"LOW","score":3.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.0056,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48846","published":"2026-05-25T19:21:09.656Z","updated":"2026-05-26T13:05:56.818Z","title":"In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail…","severity":"MEDIUM","score":6.5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48845","published":"2026-05-25T19:18:09.549Z","updated":"2026-05-27T03:55:26.292Z","title":"In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private…","severity":"MEDIUM","score":6.5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00377,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48844","published":"2026-05-25T19:14:48.753Z","updated":"2026-05-26T12:48:17.535Z","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code…","severity":"HIGH","score":7.5,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00414,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48843","published":"2026-05-25T19:11:04.351Z","updated":"2026-05-26T12:50:42.557Z","title":"Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may…","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00268,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48842","published":"2026-05-25T19:06:37.434Z","updated":"2026-09-25T03:55:21.992Z","title":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…","severity":"HIGH","score":8.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.01699,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35545","published":"2026-04-03T04:02:06.765Z","updated":"2026-04-03T15:36:13.062Z","title":"An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message.…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00409,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35544","published":"2026-04-03T03:59:49.053Z","updated":"2026-04-03T12:50:12.338Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.0038,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35543","published":"2026-04-03T03:57:06.528Z","updated":"2026-04-03T12:50:54.031Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00418,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35542","published":"2026-04-03T03:54:18.465Z","updated":"2026-04-03T12:51:27.986Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of…","severity":"MEDIUM","score":5.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00418,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35541","published":"2026-04-03T03:50:47.422Z","updated":"2026-04-03T12:52:08.638Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that…","severity":"MEDIUM","score":4.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00252,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35540","published":"2026-04-03T03:47:51.456Z","updated":"2026-04-03T12:52:38.240Z","title":"An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to…","severity":"MEDIUM","score":5.4,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00401,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35539","published":"2026-04-03T03:39:17.400Z","updated":"2026-04-03T13:10:55.717Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A…","severity":"MEDIUM","score":6.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00261,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35538","published":"2026-04-03T03:35:36.925Z","updated":"2026-04-03T13:11:22.365Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass…","severity":"LOW","score":3.1,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00426,"kevAdded":null,"exploit":false},{"id":"CVE-2026-35537","published":"2026-04-03T03:28:29.321Z","updated":"2026-04-11T14:12:39.387Z","title":"An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file…","severity":"LOW","score":3.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00482,"kevAdded":null,"exploit":false},{"id":"CVE-2026-26079","published":"2026-02-11T04:27:24.156Z","updated":"2026-02-11T16:06:28.336Z","title":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.","severity":"MEDIUM","score":4.7,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00355,"kevAdded":null,"exploit":false},{"id":"CVE-2026-25916","published":"2026-02-09T08:14:10.177Z","updated":"2026-02-09T15:05:40.859Z","title":"Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when \"Block remote images\" is used, does not block SVG feImage.","severity":"MEDIUM","score":4.3,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00756,"kevAdded":null,"exploit":false},{"id":"CVE-2025-68461","published":"2025-12-18T05:00:54.423Z","updated":"2026-10-01T18:12:05.532Z","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":true,"epss":0.27407,"kevAdded":"2026-02-20","exploit":true},{"id":"CVE-2025-68460","published":"2025-12-18T04:54:13.338Z","updated":"2025-12-18T18:53:53.491Z","title":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.","severity":"HIGH","score":7.2,"vendor":"Roundcube","product":"Webmail","kev":false,"epss":0.00284,"kevAdded":null,"exploit":false},{"id":"CVE-2025-49113","published":"2025-06-02T00:00:00.000Z","updated":"2026-02-21T04:56:23.141Z","title":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not…","severity":"CRITICAL","score":9.9,"vendor":"Roundcube","product":"Webmail","kev":true,"epss":0.99491,"kevAdded":"2026-02-20","exploit":true},{"id":"CVE-2023-5631","published":"2023-10-18T14:51:18.443Z","updated":"2025-10-21T23:05:34.074Z","title":"Stored XSS vulnerability in Roundcube","severity":"MEDIUM","score":6.1,"vendor":"Roundcube","product":"Roundcubemail","kev":true,"epss":0.76337,"kevAdded":"2023-10-26","exploit":true}]}