| CVE-2026-75002 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could…
|
7.1
Élevée
|
17 août 2026 |
| CVE-2026-75000 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by"…
|
5.8
Moyenne
|
17 août 2026 |
| CVE-2026-74999 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS
|
5.4
Moyenne
|
17 août 2026 |
| CVE-2026-74998 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were…
|
7.2
Élevée
|
17 août 2026 |
| CVE-2026-74997 |
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to…
|
8.8
Élevée
|
17 août 2026 |
| CVE-2026-54432 |
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS)
|
4.7
Moyenne
|
14 juil. 2026 |
| CVE-2026-54433 |
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted…
|
7.2
Élevée
|
14 juil. 2026 |
| CVE-2026-62644 |
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to…
|
6.4
Moyenne
|
14 juil. 2026 |
| CVE-2026-62643 |
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in…
|
7.2
Élevée
|
14 juil. 2026 |
| CVE-2026-62642 |
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which…
|
4.3
Moyenne
|
14 juil. 2026 |
| CVE-2026-62641 |
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a…
|
4.3
Moyenne
|
14 juil. 2026 |
| CVE-2026-9818 |
Roundcube's HTML sanitization path for message rendering allows loopback, localhost, RFC1918, link-local, and ULA URLs…
|
4.7
Moyenne
|
28 mai 2026 |
| CVE-2026-48849 |
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored…
|
4.4
Moyenne
|
25 mai 2026 |
| CVE-2026-48848 |
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to…
|
7.2
Élevée
|
25 mai 2026 |
| CVE-2026-48847 |
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via…
|
3.7
Faible
|
25 mai 2026 |
| CVE-2026-48846 |
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a…
|
6.5
Moyenne
|
25 mai 2026 |
| CVE-2026-48845 |
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for…
|
6.5
Moyenne
|
25 mai 2026 |
| CVE-2026-48844 |
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues…
|
7.5
Élevée
|
25 mai 2026 |
| CVE-2026-48843 |
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS)…
|
7.2
Élevée
|
25 mai 2026 |
| CVE-2026-48842 |
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the…
|
8.1
Élevée
|
25 mai 2026 |
| CVE-2026-35545 |
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15
|
5.3
Moyenne
|
3 avr. 2026 |
| CVE-2026-35544 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
5.3
Moyenne
|
3 avr. 2026 |
| CVE-2026-35543 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
5.3
Moyenne
|
3 avr. 2026 |
| CVE-2026-35542 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
5.3
Moyenne
|
3 avr. 2026 |
| CVE-2026-35541 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
4.2
Moyenne
|
3 avr. 2026 |