Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Roundcube Webmail の CVE-2026-62643 を掲載しました。HTML メールの CSS の無害化不足で、メールを1通送るだけで SSRF が成立します。NVD の Primary は CVSS 10.0。クラウド上ならインスタンスメタデータへの到達が最… https://cve.autoarticles.net/cve/CVE-2026-62643
Post summary
A disclosure of Roundcube Webmail CVE‑2026‑62643 highlighting SSRF via unsanitized CSS and a CVSS score of 10.0, with no PoC or exploit tool detailed.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | roundcube | webmail | - | - | - |