Veille CVE

Vendredi 24 juillet 2026

7 CVE

Critique 0 Élevée 3 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Roundcube Webmail » ✕
  1. CVE-2026-48849 4.4 Moyenne

    Roundcube Webmail

    In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

  2. CVE-2026-48848 7.2 Élevée

    Roundcube Webmail

    Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

  3. CVE-2026-48847 3.7 Faible

    Roundcube Webmail

    Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.

  4. CVE-2026-48846 6.5 Moyenne

    Roundcube Webmail

    In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

  5. CVE-2026-48845 6.5 Moyenne

    Roundcube Webmail

    In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

  6. CVE-2026-48844 7.5 Élevée

    Roundcube Webmail

    Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

  7. CVE-2026-48843 7.2 Élevée

    Roundcube Webmail

    Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.