[ Vendor · 34 CVEs ]
Roundcube
CVEs affecting Roundcube published in the last 30 days, plus any Roundcube CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114729 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL… | |
| CVE-2026-114730 | 22 Oct 2026 | CVSS 7.2 | Roundcube WebmailRoundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used… | |
| CVE-2026-114731 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the… | |
| CVE-2026-114732 | 22 Oct 2026 | CVSS 6.8 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a… | |
| CVE-2026-114722 | 22 Oct 2026 | CVSS 6.5 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not… | |
| CVE-2026-114723 | 22 Oct 2026 | CVSS 3.7 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When… | |
| CVE-2026-114724 | 22 Oct 2026 | CVSS 7.4 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed… | |
| CVE-2026-114725 | 22 Oct 2026 | CVSS 5.0 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline… | |
| CVE-2026-114726 | 22 Oct 2026 | CVSS 5.8 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action… | |
| CVE-2026-114727 | 22 Oct 2026 | CVSS 8.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were… | |
| CVE-2026-114728 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes… | |
| CVE-2026-114716 | 22 Oct 2026 | CVSS 8.5 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images()… | |
| CVE-2026-114717 | 22 Oct 2026 | CVSS 4.0 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an… | |
| CVE-2026-114718 | 22 Oct 2026 | CVSS 4.7 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text… | |
| CVE-2026-114719 | 22 Oct 2026 | CVSS 3.7 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin… | |
| CVE-2026-114720 | 22 Oct 2026 | CVSS 7.1 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can… | |
| CVE-2026-114721 | 22 Oct 2026 | CVSS 3.1 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the… | |
| CVE-2026-114715 | 22 Oct 2026 | CVSS 6.8 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password… | |
| CVE-2026-114714 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the… | |
| CVE-2026-113386 | 20 Oct 2026 | CVSS 7.1 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via… | |
| CVE-2025-68461 | 18 Dec 2025 | CVSS 6.1 | RoundCube Webmail Cross-site ScriptingRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. | ExploitedFix |
| CVE-2025-49113 | 2 Jun 2025 | CVSS 8.8 | RoundCube Webmail Deserialization of Untrusted DataRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is… | ExploitedFix |
| CVE-2024-42009 | 5 Aug 2024 | CVSS 9.3 | RoundCube Webmail Cross-Site ScriptingA Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim… | Exploited |
| CVE-2024-37383 | 7 Jun 2024 | CVSS 6.1 | RoundCube Webmail Cross-Site Scripting (XSS)Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | ExploitedFix |
| CVE-2024-37383 | 7 Jun 2024 | CVSS 6.1 | RoundCube Webmail Cross-Site Scripting (XSS)Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | ExploitedFix |
| CVE-2023-5631 | 18 Oct 2023 | CVSS 5.4 | Roundcube Webmail Persistent Cross-Site Scripting (XSS)Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because… | ExploitedFix |
| CVE-2023-43770 | 22 Sep 2023 | CVSS 6.1 | Roundcube Webmail Persistent Cross-Site Scripting (XSS)Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of… | ExploitedFix |
| CVE-2023-43770 | 22 Sep 2023 | CVSS 6.1 | Roundcube Webmail Persistent Cross-Site Scripting (XSS)Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of… | ExploitedFix |
| CVE-2021-44026 | 19 Nov 2021 | CVSS 9.8 | Roundcube Webmail SQL InjectionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. | ExploitedFix |
| CVE-2020-35730 | 28 Dec 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text… | ExploitedFix |
| CVE-2020-13965 | 9 Jun 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is… | ExploitedFix |
| CVE-2020-13965 | 9 Jun 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is… | ExploitedFix |
| CVE-2020-12641 | 4 May 2020 | CVSS 9.8 | Roundcube Webmail Remote Code Executionrcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for… | ExploitedFix |
| CVE-2017-16651 | 9 Nov 2017 | CVSS 7.8 | Roundcube Webmail File DisclosureRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem… | ExploitedFix |