CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses f...

CVE-2026-74998

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 fail to validate CSS proxy responses, enabling XSS or information disclosure through MIME sniffing. CVSS 7.2 (HIGH), network-reachable with no privileges. No in-the-wild exploitation reported. Fix: upgrade to 1.6.18 or 1.7.3 (commits...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

EUVD-2026-60165

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...