Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-48849
4.4
MEDIUMCVSS v3
Published
May 25, 2026
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.
GitHub