Debian/roundcube: high 7.2
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scrip
Action: Upgrade roundcube to 1.6.18+dfsg-0+deb13u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.18+dfsg-0+deb13u1 | - |
Fixed versions
| 1.6.18+dfsg-0+deb13u1 |
Sources
- osv: DEBIAN-CVE-2026-74998#Debian:13/roundcube
- https://security-tracker.debian.org/tracker/CVE-2026-74998
published · modified · JSON