Vulnerabilidades em Roundcube
39 resultadosAnálise Vexday
Roundcube apresenta 29 vulnerabilidades catalogadas, com 14 divulgadas nos últimos 90 dias indicando ritmo elevado de descobertas recentes; 3 estão sob exploração ativa (KEV), embora apenas 1 seja crítica. A fraqueza dominante é CWE-669 (configuração imprópria), sugerindo que o risco concentra-se mais em má configuração e exposição do que em falhas de código severas.
CVE-2026-75000MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remoEPSS 0.5%CVE-2026-25916MEDIUMRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.EPSS 0.5%CVE-2026-62641MEDIUMIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF siEPSS 0.5%CVE-2026-48843HIGHRoundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML EPSS 0.5%CVE-2026-48848HIGHRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSSEPSS 0.4%CVE-2026-48845MEDIUMIn Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to locaEPSS 0.4%CVE-2026-62643HIGHIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages maEPSS 0.4%CVE-2026-74998HIGHIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which mEPSS 0.4%CVE-2026-35540MEDIUMAn issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messEPSS 0.4%CVE-2026-75010MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authenticationEPSS 0.4%CVE-2026-75004MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypEPSS 0.4%CVE-2026-35538LOWAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injectioEPSS 0.4%CVE-2026-35539MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in prEPSS 0.4%CVE-2026-35541MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to tyEPSS 0.3%CVE-2026-54433HIGHIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email messageEPSS 0.3%CVE-2026-74999MEDIUMIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.EPSS 0.3%CVE-2025-68460HIGHRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.EPSS 0.3%CVE-2026-48849MEDIUMIn Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to storEPSS 0.3%CVE-2026-54432MEDIUMRoundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIMEPSS 0.2%