WE
Product
Webmail
by Roundcube · last CVE Oct 22, 2026
On CISA KEVExploited in the wild
126
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 58Low 5
Watch

Add Webmail to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-44026
In wildKEV
9.8
70%
Nov 19
Roundcube Webmail SQL Injection Vulnerability
Affected: before 1.3.17; 1.4.0 before 1.4.12
CVE-2020-12641
In wildKEV
9.8
84%
May 4
Roundcube Webmail Remote Code Execution Vulnerability
Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4
CVE-2024-42009
In wildKEV
9.3
83%
Aug 5
RoundCube Webmail Cross-Site Scripting Vulnerability
Affected: before 1.5.8; 1.6.0 before 1.6.8
Showing 3