Roundcube Webmail vulnerabilities

• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication... CVE-2026-114732 Fix available 6.8 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource... CVE-2026-114731 Fix available 5.3 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side... CVE-2026-114730 Fix available 7.2 HighOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking... CVE-2026-114729 Fix available 5.3 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking... CVE-2026-114728 Fix available 5.3 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into... CVE-2026-114727 Fix available 8.3 HighOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... CVE-2026-114726 Fix available 5.8 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... CVE-2026-114725 Fix available 5.0 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in... CVE-2026-114724 Fix available 7.4 HighOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to... CVE-2026-114723 Fix available 3.7 LowOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in... CVE-2026-114722 Fix available 6.5 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration... CVE-2026-114721 Fix available 3.1 LowOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection... CVE-2026-114720 Fix available 7.1 HighOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in... CVE-2026-114719 Fix available 3.7 LowOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting... CVE-2026-114718 Fix available 4.7 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... CVE-2026-114717 Fix available 4.0 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection... CVE-2026-114716 Fix available 8.5 HighOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization... CVE-2026-114715 Fix available 6.8 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal... CVE-2026-114714 Fix available 5.3 MediumOctober 22, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A... CVE-2026-113386 Fix available 7.1 HighOctober 20, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password... CVE-2026-75010 Fix available 6.4 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to... CVE-2026-75007 Fix available 5.4 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets ... CVE-2026-75006 Fix available 5.8 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead... CVE-2026-75004 Fix available 4.3 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI... CVE-2026-75003 Fix available 5.8 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count... CVE-2026-75002 Fix available 7.1 HighAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the... CVE-2026-75000 Fix available 5.8 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was... CVE-2026-74999 Fix available 5.4 MediumAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading... CVE-2026-74998 Fix available 7.2 HighAugust 17, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk... CVE-2026-74997 Fix available 8.8 HighAugust 17, 2026
• bulwarkmail webmail Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS).... CVE-2026-54432 Fix available 4.7 MediumJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting ... CVE-2026-54433 Public exploitFix available 7.2 HighJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube... CVE-2026-62644 Fix available 6.4 MediumJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets ... CVE-2026-62643 Fix available 7.2 HighJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the... CVE-2026-62642 Fix available 4.3 MediumJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial... CVE-2026-62641 Fix available 4.3 MediumJuly 14, 2026
• bulwarkmail webmail In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in... CVE-2026-48849 Public exploitFix available 4.4 MediumMay 25, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization... CVE-2026-48848 Fix available 7.2 HighMay 25, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary... CVE-2026-48847 Fix available 3.7 LowMay 25, 2026
• bulwarkmail webmail In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking... CVE-2026-48846 Fix available 6.5 MediumMay 25, 2026
• bulwarkmail webmail In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image... CVE-2026-48845 Fix available 6.5 MediumMay 25, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic... CVE-2026-48844 Fix available 7.5 HighMay 25, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient... CVE-2026-48843 Fix available 7.2 HighMay 25, 2026
• bulwarkmail webmail Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection... CVE-2026-48842 Public exploitFix available 8.1 HighMay 25, 2026
• bulwarkmail webmail Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message CVE-2026-35545 Fix available 5.3 MediumApril 3, 2026
• bulwarkmail webmail Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35544 Fix available 5.3 MediumApril 3, 2026
• bulwarkmail webmail Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message CVE-2026-35543 Fix available 5.3 MediumApril 3, 2026
• bulwarkmail webmail Roundcube: Bypass of remote image blocking via crafted BODY background attribute CVE-2026-35542 Fix available 5.3 MediumApril 3, 2026
• bulwarkmail webmail Roundcube Webmail: Incorrect password comparison in the password plugin CVE-2026-35541 Fix available 4.2 MediumApril 3, 2026
• bulwarkmail webmail Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages CVE-2026-35540 Fix available 5.4 MediumApril 3, 2026
• Show olderLoading…