Skip to contentBulwarkmail Webmail vulnerabilities
- bulwarkmail webmailRoundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail messageCVE-2026-35543Fix available5.3 Medium
- bulwarkmail webmailRoundcube: Bypass of remote image blocking via crafted BODY background attributeCVE-2026-35542Fix available5.3 Medium
- bulwarkmail webmailRoundcube Webmail: Incorrect password comparison in the password pluginCVE-2026-35541Fix available4.2 Medium
- bulwarkmail webmailRoundcube Webmail: Insufficient CSS sanitization in HTML e-mail messagesCVE-2026-35540Fix available5.4 Medium
- bulwarkmail webmailRoundcube Webmail: Insufficient HTML attachment sanitization in preview modeCVE-2026-35539Fix available6.1 Medium
- bulwarkmail webmailRoundcube Webmail: Unsanitized IMAP SEARCH command argumentsCVE-2026-35538Fix available3.1 Low
- bulwarkmail webmailRoundcube Webmail: Unsafe deserialization in the redis/memcache session handlerCVE-2026-35537Fix available3.7 Low
- bulwarkmail webmailBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validationCVE-2026-348348.7 High
- bulwarkmail webmailBulwark Webmail: Information Exposure: password returned in /api/auth/sessionCVE-2026-348338.7 High
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)...CVE-2026-26079Fix available4.7 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does...CVE-2026-25916Public exploitFix available4.3 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...CVE-2025-68461In KEVPublic exploitFix availableEPSS 27.4%7.2 High
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure...CVE-2025-68460Fix available7.2 High
- bulwarkmail webmail, debian linux +1 moreRoundcube Webmail Vulnerable to Authenticated RCE via PHP Object DeserializationCVE-2025-49113In KEVPublic exploitFix availableEPSS 99.6%9.9 Critical