WE
Product
Webmail
On CISA KEVExploited in the wild
124
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 56Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44026 In wildKEV | 9.8 | Nov 19 | Roundcube Webmail SQL Injection Vulnerability Affected: before 1.3.17; 1.4.0 before 1.4.12 |
| CVE-2020-12641 In wildKEV | 9.8 | May 4 | Roundcube Webmail Remote Code Execution Vulnerability Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4 |
| CVE-2024-42009 In wildKEV | 9.3 | Aug 5 | RoundCube Webmail Cross-Site Scripting Vulnerability Affected: before 1.5.8; 1.6.0 before 1.6.8 |
| CVE-2025-49113 In wildKEV | 8.8 | Jun 2 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability Affected: before 1.5.10; 1.6.0 before 1.6.11 |
| CVE-2017-16651 In wildKEV | 7.8 | Nov 9 | Roundcube Webmail File Disclosure Vulnerability Affected: through 1.1.9; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +5 more |
| CVE-2025-68461 In wildKEV | 6.1 | Dec 18 | RoundCube Webmail Cross-site Scripting Vulnerability Affected: before 1.5.12; 1.6.0 before 1.6.12 |
| CVE-2024-37383 In wildKEV | 6.1 | Jun 7 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2023-43770 In wildKEV | 6.1 | Sep 22 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Affected: before 1.4.14; 1.5.0 before 1.5.4; 1.6.0 before 1.6.3 |
| CVE-2020-35730 In wildKEV | 6.1 | Dec 28 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.2.13; 1.3.0 before 1.3.16; 1.4 before 1.4.10 |
| CVE-2020-13965 In wildKEV | 6.1 | Jun 9 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.3.12; 1.4.0 before 1.4.5 |
| CVE-2023-5631 In wildKEV | 5.4 | Oct 18 | Stored XSS vulnerability in Roundcube Affected: before 1.4.15; 1.5.0 before 1.5.5; 1.6.0 before 1.6.4 |
| CVE-2026-54433 | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-62643 | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-75003 | 9.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-62644 | 9.8 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2024-37385 | 9.8 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2020-12640 | 9.8 | May 4 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4 |
| CVE-2024-42008 | 9.3 | Aug 5 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a… Affected: before 1.5.8; 1.6.0 before 1.6.8 |
| CVE-2026-75007 | 8.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-74997 | 8.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2018-9846 | 8.8 | Apr 7 | In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an… Affected: 1.2.0 through 1.3.5 |
| CVE-2017-8114 | 8.8 | Apr 29 | Roundcube Webmail allows arbitrary password resets by authenticated users Affected: before 1.0.11; 1.1.0 before 1.1.9; 1.2.0 before 1.2.5 |
| CVE-2015-2181 | 8.8 | Jan 30 | Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2)… Affected: before 1.1.0 |
| CVE-2015-2180 | 8.8 | Jan 30 | The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password Affected: through 1.1 |
| CVE-2016-4069 | 8.8 | Aug 25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download… Affected: through 1.1.4 |
| CVE-2026-114716 New | 8.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114727 New | 8.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-35545 | 8.2 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15 Affected: before 1.5.15; 1.6.0 before 1.6.15 |
| CVE-2026-48842 | 8.1 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-48844 | 7.5 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-35537 | 7.5 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2025-68460 | 7.5 | Dec 18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer Affected: before 1.5.12; 1.6.0 before 1.6.12 |
| CVE-2018-19205 | 7.5 | Nov 12 | Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688 Affected: before 1.3.7 |
| CVE-2018-1000071 | 7.5 | Mar 13 | roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key Affected: through 1.3.4 |
| CVE-2015-5383 | 7.5 | May 23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory Affected: 1.1; 1.1; 1.1 |
| CVE-2016-9920 | 7.5 | Dec 8 | steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use… Affected: through 1.1.6; 1.2.0; 1.2.1; 1.2.2 |
| CVE-2026-114724 New | 7.4 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2019-15237 | 7.4 | Aug 20 | Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks Affected: through 1.3.9 |
| CVE-2026-114730 New | 7.2 | Oct 22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass Affected: 1.6.14 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-74998 | 7.2 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-48848 | 7.2 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that… Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-48843 | 7.2 | May 25 | Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or… Affected: 1.6.14 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-114720 New | 7.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-113386 | 7.1 | Oct 20 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-75002 | 7.1 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-114732 New | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114715 New | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114722 New | 6.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-62642 | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-62641 | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |