WE
Product
Webmail
On CISA KEVExploited in the wild
126
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 58Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44026 In wildKEV | 9.8 | Nov 19 | Roundcube Webmail SQL Injection Vulnerability Affected: before 1.3.17; 1.4.0 before 1.4.12 |
| CVE-2020-12641 In wildKEV | 9.8 | May 4 | Roundcube Webmail Remote Code Execution Vulnerability Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4 |
| CVE-2024-42009 In wildKEV | 9.3 | Aug 5 | RoundCube Webmail Cross-Site Scripting Vulnerability Affected: before 1.5.8; 1.6.0 before 1.6.8 |
| CVE-2025-49113 In wildKEV | 8.8 | Jun 2 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability Affected: before 1.5.10; 1.6.0 before 1.6.11 |
| CVE-2017-16651 In wildKEV | 7.8 | Nov 9 | Roundcube Webmail File Disclosure Vulnerability Affected: through 1.1.9; 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +5 more |
| CVE-2025-68461 In wildKEV | 6.1 | Dec 18 | RoundCube Webmail Cross-site Scripting Vulnerability Affected: before 1.5.12; 1.6.0 before 1.6.12 |
| CVE-2024-37383 In wildKEV | 6.1 | Jun 7 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2023-43770 In wildKEV | 6.1 | Sep 22 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Affected: before 1.4.14; 1.5.0 before 1.5.4; 1.6.0 before 1.6.3 |
| CVE-2020-35730 In wildKEV | 6.1 | Dec 28 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.2.13; 1.3.0 before 1.3.16; 1.4 before 1.4.10 |
| CVE-2020-13965 In wildKEV | 6.1 | Jun 9 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.3.12; 1.4.0 before 1.4.5 |
| CVE-2023-5631 In wildKEV | 5.4 | Oct 18 | Stored XSS vulnerability in Roundcube Affected: before 1.4.15; 1.5.0 before 1.5.5; 1.6.0 before 1.6.4 |
Showing 11