CVE-2026-26079
Medium · 4.7CVSS
4.7
EPSS
0.6%
Published
Feb 11, 2026
CISA due date
—
The record
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | roundcubemail | 0 | 1.6.13-bp160.1.1 |
Related vulnerabilities
- CVE-2026-35537 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Also affects roundcubemail
- CVE-2026-25916 Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is… Also affects roundcubemail
- CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting… Also affects roundcubemail
- CVE-2025-68460 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information… Also affects roundcubemail
- CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content… CWE-829
- CVE-2026-0303 A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow… CWE-829
- CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.1 or… CWE-829
- CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before… CWE-829