Threat database

CVE-2026-74998 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It affects versions before 1.6.18 and 1.7.x before 1.7.3. The issue arises because responses from the CSS proxy were not properly validated, potentially allowing information disclosure or XSS attacks via MIME sniffing.

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

CVE-2026-62644 is an authentication bypass vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. The issue arises from username spoofing via session data in the password plugin, potentially allowing an attacker to take over user accounts. The vulnerability has a medium severity with a CVSS score of 6.4.

Roundcube Webmail versions before 1.6.17 and 1.7.2 contain a Server-Side Request Forgery (SSRF) vulnerability due to insufficient sanitization of CSS in HTML email messages. This flaw may allow SSRF or information disclosure if stylesheet links reference local network hosts. The issue stems from incomplete fixes for earlier vulnerabilities CVE-2026-35540 and CVE-2026-48843.

An infinite loop vulnerability exists in the TNEF decoder of Roundcube Webmail versions 1.6.0 and 1.7.0. This flaw may cause a denial of service when a user opens an email containing a TNEF attachment. The vulnerability is identified as CWE-835 and has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-62641 is a medium severity vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. It involves the TNEF decoder being vulnerable to denial of service via a crafted compressed-RTF size, leading to allocation of resources without limits or throttling.

CVE-2026-48848 is a high-severity vulnerability in Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7. It involves insufficient HTML sanitization that allows Cascading Style Sheets (CSS) injection through an SVG document containing an animate element with the attributeName attribute. This vulnerability is categorized as CWE-79, indicating improper neutralization of input during web page generation, commonly known as Cross-site Scripting (XSS).

CVE-2026-48847 is a vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0 that allows an unauthenticated attacker to delete arbitrary files by exploiting session poisoning via redis or memcache. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between spheres. The CVSS score is 3.7, reflecting a low severity impact primarily affecting availability with no confidentiality or integrity impact.

CVE-2026-48844 is a high-severity vulnerability in Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1. It involves insecure code evaluation logic in the LDAP autovalues option, which could lead to code injection.

Roundcube Webmail versions 1.6.14 and 1.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability due to insufficient sanitization of CSS in HTML email messages. This flaw may allow attackers to cause the server to make unintended requests, potentially disclosing information if stylesheet links point to internal network hosts. The vulnerability is a result of an incomplete fix for a previous issue (CVE-2026-35540).

CVE-2026-48849 is a medium severity stored cross-site scripting (XSS) vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0. It arises from improper neutralization of the subject field in draft restored values, allowing injection of malicious HTML or script code in shared mailboxes. This vulnerability requires low privileges and user interaction, with a high attack complexity. No official patch or remediation guidance is currently available.

CVE-2026-48846 is a medium severity vulnerability in Roundcube Webmail versions 1.6.0 through 1.6.15 and 1.7.0. It allows bypassing the remote image blocking feature via a crafted CSS var() value in an email message. This bypass may lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet.

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

CVE-2026-35545 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.15 and 1.6.15. It allows bypassing the remote image blocking feature through specially crafted SVG content in email messages, specifically using the animate element with attributeName set to fill, filter, or stroke. This vulnerability may lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.

CVE-2026-35544 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It involves insufficient sanitization of CSS in HTML email messages, allowing a bypass of fixed-position mitigations through the use of the ! important CSS directive. This vulnerability does not impact confidentiality or availability but can lead to integrity issues. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.

CVE-2026-35543 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It allows bypassing the remote image blocking feature by using SVG content with animate attributes in email messages. This bypass can lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet. There are no known exploits in the wild at this time.

CVE-2026-35542 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It allows bypassing the remote image blocking feature through a crafted background attribute in the BODY element of an email message. This bypass can lead to information disclosure or access-control bypass. The vulnerability is related to incorrect resource transfer between security spheres (CWE-669). No official patch or remediation level has been confirmed yet.

CVE-2026-35541 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It involves a type confusion issue in the password plugin where an incorrect password comparison allows an attacker to change the password without knowing the old password. This flaw could enable unauthorized password changes, potentially leading to account compromise. No official patch or remediation level has been confirmed yet. The vulnerability has a CVSS score of 4.2, indicating a moderate risk.