Threats affecting pkg:deb/roundcubemail

This security update for Roundcube Webmail 1.6 addresses multiple vulnerabilities including a pre-authentication arbitrary file write via unsafe deserialization in the redis/memcache session handler (CVE-2026-35537). Additional fixes include prevention of unauthorized password changes, IMAP injection and CSRF bypass in mail search, remote image blocking bypasses via SVG animate attributes and crafted body background attributes, XSS in HTML attachment preview, and SSRF with information disclosure via stylesheet links. The update also resolves regressions affecting mail search with non-ASCII criteria and data URL image handling. Users of Roundcube 1.6.x are recommended to update to version 1.6.15 to mitigate these issues.