Webmail
This hub aggregates every CVE we track for Webmail, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.
Communicationsweb app
110
CVEs tracked
8
Critical
26
High
11
In CISA KEV
Severity distribution
MEDIUM67HIGH26LOW9CRITICAL8
Monthly trend
0
2
0
0
0
0
0
1
0
0
0
1
0
0
0
0
0
2
0
2
0
14
8
0
2024-072026-06
Latest CVEs
The 15 most recently published vulnerabilities affecting Webmail.
- CVE-2026-48849In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.4.4
- CVE-2026-48848Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate eleme...7.2
- CVE-2026-48847Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.3.7
- CVE-2026-48846In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information ...6.5
- CVE-2026-48845In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information dis...6.5
- CVE-2026-48844Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has bee...7.5
- CVE-2026-48843Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosur...7.2
- CVE-2026-48842Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.8.1
- CVE-2026-35391Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery7.5
- CVE-2026-35390Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks5.4
- CVE-2026-35389Bulwark Webmail S/MIME signature verification accepted self-signed certificates7.5
- CVE-2026-35545An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosur...5.3
- CVE-2026-35544An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass ...5.3
- CVE-2026-35543An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lea...5.3
- CVE-2026-35542An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. T...5.3
Product normalization is registry-driven with AI assist and human review. How it works