CVE-2026-25916

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

List of 13,262 websites affected by CVE-2026-25916

The domain names are hidden due to the sensitivity of the data. Please click on the "Contact us" button above to get more information.

Domain	Country	Rank
************.*.br	Brazil	,**
***********.***.*.br	Brazil	,*
**.***.com	Canada	,*
*****.***.hosting	Ireland	*,*
*****.***.net	Czech Republic	*,*
*****.******.com	Austria	*,*
***.hu	Hungary	*,*
**.*****.edu	Canada	*,*
*.***.*********.com	United States	*,*
***************.de	Germany	*,*
.**.fr	France	*,*
*******.net	United Arab Emirates	*,*
*****.********.no	Norway	*,*
**********.ro	Romania	*,*
*******.de	Germany	*,*
*****.*******.com	United States	*,*
*****.****.net		*,*
*****.**.pl	Poland	*,*
*****.**********.it	Italy	*,*
*********.com	Turkey	*,*

Domain	Country	Rank
************.*.br	Brazil	,**
***********.***.*.br	Brazil	,*
**.***.com	Canada	,*
*****.***.hosting	Ireland	*,*
*****.***.net	Czech Republic	*,*
*****.******.com	Austria	*,*
***.hu	Hungary	*,*
**.*****.edu	Canada	*,*
*.***.*********.com	United States	*,*
***************.de	Germany	*,*
.**.fr	France	*,*
*******.net	United Arab Emirates	*,*
*****.********.no	Norway	*,*
**********.ro	Romania	*,*
*******.de	Germany	*,*
*****.*******.com	United States	*,*
*****.****.net		*,*
*****.**.pl	Poland	*,*
*****.**********.it	Italy	*,*
*********.com	Turkey	*,*