Debian/roundcube: high 7.2
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scrip
Action: Upgrade roundcube to 1.6.18+dfsg-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.18+dfsg-1 | - |
Fixed versions
| 1.6.18+dfsg-1 |
Sources
- osv: DEBIAN-CVE-2026-74998#Debian:14/roundcube
- https://security-tracker.debian.org/tracker/CVE-2026-74998
published · modified · JSON