High severity7.2NVD Advisory· Published Aug 17, 2026· Updated Sep 8, 2026
CVE-2026-74998
CVE-2026-74998
Description
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.6.18, <1.7.3
Patches
Vulnerability mechanics
References
5- github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43bnvdPatch
- github.com/roundcube/roundcubemail/commit/a2334990c02f7cb77b1a8d6fa97fcd9e1b5cd1fbnvdPatch
- roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3nvdVendor Advisory
- github.com/roundcube/roundcubemail/releases/tag/1.6.18nvdRelease Notes
- github.com/roundcube/roundcubemail/releases/tag/1.7.3nvdRelease Notes
News mentions
0No linked articles in our index yet.