{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-28T12:21:34.860","vulnerabilities":[{"cve":{"id":"CVE-2026-54433","sourceIdentifier":"cve@mitre.org","published":"2026-07-14T17:17:05.530","lastModified":"2026-10-24T21:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click)."},{"lang":"es","value":"En Roundcube Webmail antes de 1.6.17 y 1.7.x antes de 1.7.2, existe Cross-Site Scripting Almacenado (XSS) a través de un mensaje de correo electrónico de texto plano manipulado. El JavaScript controlado por el atacante se ejecuta dentro de la sesión autenticada de la víctima simplemente al abrir o previsualizar el mensaje (zero-click)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Roundcube","product":"Webmail","defaultStatus":"unaffected","versions":[{"version":"1.6.0","lessThan":"1.6.17","versionType":"semver","status":"affected"},{"version":"1.7.0","lessThan":"1.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-15T14:10:21.104776Z","id":"CVE-2026-54433","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionEndExcluding":"1.6.17","matchCriteriaId":"E15BCA44-7E8E-422F-BBC5-549CF4477061"},{"vulnerable":true,"criteria":"cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*","versionStartIncluding":"1.7.0","versionEndExcluding":"1.7.2","matchCriteriaId":"58061F28-9D4F-4D65-8C64-F77410B6E144"}]}]}],"references":[{"url":"https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}}]}