CVE-2026-74998
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure o…
Published: 2026-08-17 · CVSS: 7.2 · CVSS 3.1
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7