Server-Side Request Forgery

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosur…CVE-2026-75006Roundcube · CVSS 5.8 · 0.4% likely

   CWE-918

2. Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url()…CVE-2026-114730Roundcube · CVSS 7.2 · 0.4% likely

   CWE-918

3. In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosur…CVE-2026-62643Roundcube · CVSS 7.2 · 0.3% likely

   CWE-918

4. Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Inf…CVE-2026-48843Roundcube · CVSS 7.2 · 0.3% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.