CVE-2021-26925

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.

• CWE-79

• https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
• https://roundcube.net/news/2021/02/08/security-update-1.4.11Release Notes, Third Party Advisory
• https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
• https://roundcube.net/news/2021/02/08/security-update-1.4.11Release Notes, Third Party Advisory

Published

Feb 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26918The ProBot bot through 2021-02-08 for Discord might allow at…9.8
• CVE-2021-26919Apache Druid allows users to read data from other database s…8.8
• CVE-2021-26920In the Druid ingestion system, the InputSource is used for r…6.5
• CVE-2021-26921In util/session/sessionmanager.go in Argo CD before 1.8.4, t…6.5
• CVE-2021-26923An issue was discovered in Argo CD before 1.8.4. Accessing t…7.5
• CVE-2021-26924An issue was discovered in Argo CD before 1.8.4. Browser XSS…6.1
• CVE-2021-26926A flaw was found in jasper before 2.0.25. An out of bounds r…7.1
• CVE-2021-26927A flaw was found in jasper before 2.0.25. A null pointer der…5.5
• CVE-2021-26928BIRD through 2.0.7 does not provide functionality for passwo…6.8
• CVE-2021-26929An XSS issue was discovered in Horde Groupware Webmail Editi…6.1
• CVE-2021-26930An issue was discovered in the Linux kernel 3.11 through 5.1…7.8
• CVE-2021-26931An issue was discovered in the Linux kernel 2.6.39 through 5…5.5