CVE-2026-35545
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Apr 3, 2026
CISA due date
—
The record
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping… CWE-669
- CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly… CWE-669
- CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a… CWE-669
- CVE-2026-98125 In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale… CWE-669
- CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal… CWE-669
- CVE-2026-25832 In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts… CWE-669
- CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2)… CWE-669
- CVE-2026-89162 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary… CWE-669