VDB
CISA-2026-26079
CISA-2026-26079
PUBLISHED
CVSS 4.7 MEDIUM
Reported by mitre · Published February 11, 2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
Risk Scores
CVSS 3.1
4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | 0, 1.6.0 |
| Roundcube | Webmail | 1.6.0, 0, 1.6.0 |
| roundcube | webmail | 0, 1.6.0, 0 |
Timeline
- Feb 11, 2026 CVE Published
- Feb 11, 2026 CVE Updated