TI-2026-39305 CVE-2026-54432 · GHSA-w8fm-hrh6-r2j7
Cross-site scripting in Roundcube Webmail
Priority LOW 21
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS).
Vulnerabilities
6 records
TI-2026-39306 CVE-2026-54433 · GHSA-6hj3-f24f-rwj8
Cross-site scripting in Roundcube Webmail
Priority MEDIUM 49
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message.
TI-2026-44758 CVE-2026-62644 · GHSA-q4q9-gcgm-p77w
Authentication bypass by spoofing in Roundcube Webmail
Priority MEDIUM 42
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.
TI-2026-44757 CVE-2026-62643 · GHSA-5q79-cfqm-5cxh
Server-side request forgery in Roundcube Webmail
Priority MEDIUM 49
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to loc…
TI-2026-44756 CVE-2026-62642 · GHSA-345h-r9m2-jr4p
Infinite loop in Roundcube Webmail
Priority LOW 29
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
TI-2026-44755 CVE-2026-62641 · GHSA-wvvp-c8qh-3cc5
Resource allocation without limits in Roundcube Webmail
Priority LOW 28
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.