CVE-2026-26079

Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 11 Feb 2026, 04:27
Last modified:11 Feb 2026, 16:06

Vulnerability Summary

Overall Risk (default)
low
19/100
CVSS Score
4.7 MEDIUM
v3.1 (cve.org)
EPSS Score
0.09% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Feb 2026, 04:27
Published
Vulnerability first disclosed
11 Feb 2026, 16:06
Last Modified
Vulnerability information updated

Description

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.09%• Percentile: 25%

Techniques & Countermeasures

  • CWE-829•Inclusion of Functionality from Untrusted Control Sphere

    The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Affected Systems

  • roundcube•webmail

    < 1.5.13 | ≥ 1.6.0, < 1.6.13

References (9)