Skip to contentRoundcube Webmail vulnerabilities
- bulwarkmail webmailRoundcube Webmail: Insufficient HTML attachment sanitization in preview modeCVE-2026-35539Fix available6.1 Medium
- bulwarkmail webmailRoundcube Webmail: Unsanitized IMAP SEARCH command argumentsCVE-2026-35538Fix available3.1 Low
- bulwarkmail webmailRoundcube Webmail: Unsafe deserialization in the redis/memcache session handlerCVE-2026-35537Fix available3.7 Low
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)...CVE-2026-26079Fix available4.7 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does...CVE-2026-25916Public exploitFix available4.3 Medium
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...CVE-2025-68461In KEVPublic exploitFix availableEPSS 27.4%7.2 High
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure...CVE-2025-68460Fix available7.2 High
- bulwarkmail webmail, debian linux +1 moreRoundcube Webmail Vulnerable to Authenticated RCE via PHP Object DeserializationCVE-2025-49113In KEVPublic exploitFix availableEPSS 99.6%9.9 Critical
- roundcube webmailCross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated...CVE-2024-57004EPSS 40.5%6.1 Medium
- roundcube webmailA Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a...CVE-2024-42009In KEVPublic exploitFix availableEPSS 82.9%9.3 Critical
- roundcube webmailA Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7...CVE-2024-42008Public exploitFix availableEPSS 34.0%9.3 Critical
- roundcube webmailRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via...CVE-2024-373859.8 Critical
- roundcube webmail, debian linux +1 moreRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user...CVE-2024-37384Fix available6.1 Medium
- roundcube webmail, debian linux +1 moreRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.CVE-2024-37383In KEVPublic exploitFix availableEPSS 74.0%6.1 Medium
- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content...CVE-2023-47272Fix available6.1 Medium
- debian linux, fedoraproject fedora, roundcube roundcubemail +1 more +3 moreStored XSS vulnerability in RoundcubeCVE-2023-5631In KEVFix availableEPSS 76.3%6.1 Medium
- debian linux, roundcube webmail +1 moreRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...CVE-2023-43770In KEVPublic exploitFix availableEPSS 63.7%6.1 Medium
- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's...CVE-2021-44025Fix available6.1 Medium
- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search...CVE-2021-44026In KEVPublic exploitFix availableEPSS 69.9%9.8 Critical
- roundcube webmailCross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer...CVE-2020-18671Fix available5.4 Medium
- roundcube webmailCross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in ...CVE-2020-18670Fix available5.4 Medium
- fedoraproject fedora, roundcube webmail +1 moreRoundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences...CVE-2021-26925Fix available5.4 Medium
- roundcube webmail, debian linux, fedoraproject fedora +2 morelinkref_addindex in rcube_string_replacer.php in Roundcube Webmail before 1.4.10 allows XSS via a...CVE-2020-35730In KEVPublic exploitFix availableEPSS 32.9%6.1 Medium
- roundcube webmail, fedoraproject fedora +1 moreRoundcube Webmail before 1.4.8 allows stored XSS in HTML messages during message display via a...CVE-2020-16145Fix available6.1 Medium
- roundcube webmail, debian linux +1 moreAn issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before...CVE-2020-15562Fix available6.1 Medium
- roundcube webmail, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include...CVE-2020-13964Fix available6.1 Medium
- roundcube webmail, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS...CVE-2020-13965In KEVPublic exploitFix availableEPSS 76.6%6.1 Medium
- roundcube webmail, opensuse backports sle, leap +2 moreRoundcube Webmail before 1.4.4 allows attackers to include local files and execute code via...CVE-2020-12640Public exploitFix available9.8 Critical
- roundcube webmail, opensuse backports sle, leap +2 morercube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via...CVE-2020-12641In KEVPublic exploitFix availableEPSS 84.4%9.8 Critical
- roundcube webmail, debian linux, opensuse backports sle +1 more +3 moreAn issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS)...CVE-2020-12625Public exploitFix available6.1 Medium
- roundcube webmail, debian linux +1 moreAn issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an...CVE-2020-12626Fix available6.5 Medium
- roundcube webmail, fedoraproject fedora +1 moreRoundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.CVE-2019-15237Fix available7.4 High
- roundcube webmail, fedoraproject fedora, opensuse backports sle +1 more +3 moreIn Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails...CVE-2019-10740Fix available4.3 Medium
- debian linux, roundcube webmail +1 moresteps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as...CVE-2018-19206Fix availableEPSS 55.9%6.1 Medium
- roundcube webmailRoundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier...CVE-2018-19205Fix available7.5 High
- apple mail, bloop airmail, emclient +8 more +10 more** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget...CVE-2017-17688Fix availableDisputed5.9 Medium
- debian linux, roundcube webmail +1 moreIn Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's...CVE-2018-9846Fix available8.8 High
- roundcube webmailroundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma...CVE-2018-1000071Fix available7.5 High
- roundcube webmail, debian linux +1 moreRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...CVE-2017-16651In KEVPublic exploitFix availableEPSS 45.7%7.8 High
- roundcube webmailRoundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by...CVE-2015-53837.5 High
- roundcube webmailCross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x...CVE-2015-5381Fix available6.1 Medium
- roundcube webmailRoundcube Webmail allows arbitrary password resets by authenticated users. This affects versions...CVE-2017-8114Fix available8.8 High
- roundcube webmailrcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site...CVE-2017-6820Fix available6.1 Medium
- roundcube webmailCross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote...CVE-2016-4552Fix available6.1 Medium
- roundcube webmailsteps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is...CVE-2016-9920Public exploitFix available7.5 High
- roundcube webmail, opensuse leap, opensuse +2 moreCross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5...CVE-2016-4068Fix available6.1 Medium
- roundcube webmail, opensuse leap +1 moreCross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote...CVE-2016-4069Fix available8.8 High
- roundcube webmail, opensuse leap, opensuse +2 moreCross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5...CVE-2015-8864Fix available6.1 Medium
- roundcube webmailAbsolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before...CVE-2015-8794Fix available6.5 Medium
- roundcube webmailCross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6...CVE-2015-8793Fix available6.1 Medium
- Show moreLoading…