VulnSocial

CVE-2026-48849Patch

LOWCVSS 4.4 · MEDIUM

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • Peaked at 4 mentions on most recent observed day (2026-06-08)
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-05-29: 1Mentions · 2026-06-08: 4Patch / Workaround · 2026-05-29: 1Patch / Workaround · 2026-06-08: 2Technical Details · 2026-05-29: 1Technical Details · 2026-06-08: 405-2906-08
Signal classification2 categories
Patch
360.0%
Disclosure
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-291
Patch1
2026-06-084
Disclosure2Patch2
Full discourse5 posts
  • Hunter@HunterMapping
    Patch

    🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849 :Critical Roundcube Webmail Security Updates Fix Severe Flaws 📊 2.6M+ Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22Roundcube%20Webmail%22 👇Query HUNTER : http://product.name="Roundcube Webmail" 📰Refer:https://securityonline.info/roundcube-webmail-security-updates/ #hunterhow #infosec #infosecurity #OSINT #Vulnerability

    Post summary

    The post announces that Roundcube Webmail vulnerabilities CVE-2026-48842 to CVE-2026-48849, rated CVSS 8.1, have been fixed by security updates; no PoC, exploit, or active exploitation is reported.

    018183386.8K
    26.0K followersView on X
  • Lyrie.ai@lyrie_ai
    Patch

    Full Tweet 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849:Critical Roundcube Webmail Security Updates Fix Severe Flaws 📊 2.6M+ Services are found on the yearly. 🔗Hunter Link: 👇Query HUNTER:…

    Post summary

    The tweet announces critical Roundcube Webmail patches for CVE-2026‑48842/48849, noting an 8.1 CVSS score and the availability of fixes, but provides no PoC, exploit code, or active exploitation details.

    1000058
    258 followersView on X
  • Lyrie.ai@lyrie_ai
    Patch

    CVE-2026-48842: 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849:Critical Roundcube Webmail Security Updates Fix Severe Flaws 📊 2.6M+ Services are found on the yearly. 🔗Hunter Link: 👇Query…

    Post summary

    CVE-2026-48842 is a high‑CVSS vulnerability affecting Roundcube Webmail; a security update addressing the flaw is available, but no PoC, exploit code, or active exploitation reports are provided.

    1000063
    258 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    Source: X search for CVE-2026 critical Posted: 2026-05-29T02:50:57.000Z Likes: 49 0day Intel: 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849:Cr

    Post summary

    The post alerts to two new CVE entries, CVE-2026-48842 and CVE-2026-48849, with a CVSS score of 8.1, but does not mention PoC, exploits, or mitigation.

    1000067
    258 followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    0day Intel: 🚨Alert🚨 CVE-2026-48842 (CVSS 8.1) && CVE-2026-48842-CVE-2026-48849:Cr

    Post summary

    Alert announcing the newly disclosed vulnerability CVE‑2026‑48842 with a CVSS score of 8.1, without any evidence of exploits, PoC, or patches.

    1000062
    258 followersView on X

Explore more

Back to dashboard