WE
Product
Webmail
2
CVEs
0
On KEV
6.1
Max CVSS
0
New 30D
VulnerabilityMedium
[CISA KEV] CVE-2025-68461: Roundcube Webmail - RoundCube Webmail Cross-site Scripting Vulnerability
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
WEWebmailCVE-2025-68461
Feb 20, 2026·CISA KEV
VulnerabilityHigh
[CISA KEV] CVE-2025-49113: Roundcube Webmail - RoundCube Webmail Deserialization of Untrusted Data Vulnerability
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
WEWebmailCVE-2025-49113
Feb 20, 2026·CISA KEV