Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

Customers

Vulnerability IntelligenceCVE-2026-26079

CVE-2026-26079

MEDIUM4.7

Roundcube Webmail before 1

Published Feb 11, 2026

Modified 3 weeks ago

Details

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

References

WEB

https://github.com/roundcube/roundcubemail/commit/1f4c3a5af5033747f9685a8a395dbd8228d19816

WEB

https://github.com/roundcube/roundcubemail/commit/2b5625f1d2ef7e050fd1ae481b2a52dc35466447

WEB

https://github.com/roundcube/roundcubemail/commit/53d75d5dfebef235a344d476b900c20c12d52b01

WEB

https://github.com/roundcube/roundcubemail/commit/5a3315cce587e0be58335d11ff9a5571c90494a5

WEB

https://github.com/roundcube/roundcubemail/commit/bf89cbaa5897d8ad62e8057d9a3f6babb90b7954

WEB

https://github.com/roundcube/roundcubemail/commit/c15f5dbf093a497e19a749b20e7f8fb5a9c24cde

WEB

https://github.com/roundcube/roundcubemail/releases/tag/1.5.13

WEB

https://github.com/roundcube/roundcubemail/releases/tag/1.6.13

WEB

https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-26079

CVSS Analysis

CVSS v3.1

4.7

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

4.7/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness Type (CWE)

Trust

CWE-829

Untrusted Control Sphere

Ecosystems

Timeline

PublishedFeb 11, 2026

ModifiedFeb 11, 2026

CVE-2026-26079 | Mondoo Vulnerability Intelligence