WE
Product
Webmail
On CISA KEVExploited in the wild
126
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 58Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-68461 In wildKEV | 6.1 | Dec 18 | RoundCube Webmail Cross-site Scripting Vulnerability Affected: before 1.5.12; 1.6.0 before 1.6.12 |
| CVE-2024-37383 In wildKEV | 6.1 | Jun 7 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2023-43770 In wildKEV | 6.1 | Sep 22 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Affected: before 1.4.14; 1.5.0 before 1.5.4; 1.6.0 before 1.6.3 |
| CVE-2020-35730 In wildKEV | 6.1 | Dec 28 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.2.13; 1.3.0 before 1.3.16; 1.4 before 1.4.10 |
| CVE-2020-13965 In wildKEV | 6.1 | Jun 9 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: before 1.3.12; 1.4.0 before 1.4.5 |
| CVE-2023-5631 In wildKEV | 5.4 | Oct 18 | Stored XSS vulnerability in Roundcube Affected: before 1.4.15; 1.5.0 before 1.5.5; 1.6.0 before 1.6.4 |
| CVE-2026-114732 New | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114715 New | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114722 New | 6.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-62642 | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-62641 | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-48846 | 6.5 | May 25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may… Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-48845 | 6.5 | May 25 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead… Affected: 1.6.14 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-35540 | 6.5 | Apr 3 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14 Affected: 1.6.0 before 1.6.14 |
| CVE-2020-12626 | 6.5 | May 4 | An issue was discovered in Roundcube Webmail before 1.4.4 Affected: before 1.4.4 |
| CVE-2015-5382 | 6.5 | May 23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when… Affected: 1.1; 1.1; 1.1 |
| CVE-2026-35539 | 6.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2024-57004 | 6.1 | Feb 3 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering… Affected: 1.6.9 |
| CVE-2024-37384 | 6.1 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2023-47272 | 6.1 | Nov 6 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download) Affected: 1.5.0 before 1.5.6; 1.6.0 before 1.6.5 |
| CVE-2021-44025 | 6.1 | Nov 19 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message Affected: before 1.3.17; 1.4.0 before 1.4.12 |
| CVE-2020-16145 | 6.1 | Aug 12 | Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document Affected: before 1.3.15; 1.4.0 before 1.4.8 |
| CVE-2020-15562 | 6.1 | Jul 6 | An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7 Affected: before 1.2.11; 1.3.0 before 1.3.14; 1.4.0 before 1.4.7 |
| CVE-2020-13964 | 6.1 | Jun 9 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5 Affected: before 1.3.12; 1.4.0 before 1.4.5 |
| CVE-2020-12625 | 6.1 | May 4 | An issue was discovered in Roundcube Webmail before 1.4.4 Affected: before 1.4.4 |
| CVE-2018-19206 | 6.1 | Nov 12 | steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment Affected: before 1.3.8 |
| CVE-2015-5381 | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.1; 1.1; 1.1 |
| CVE-2016-4068 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: through 1.0.8; 1.1; 1.1; 1.1; 1.1.4 |
| CVE-2015-8864 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: through 1.0.8; 1.1; 1.1; 1.1; 1.1.4 |
| CVE-2017-6820 | 6.1 | Mar 12 | rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence… Affected: through 1.1.7; 1.2.0; 1.2.1; 1.2.2; 1.2.3 |
| CVE-2016-4552 | 6.1 | Dec 20 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in… Affected: 1.2 |
| CVE-2015-8793 | 6.1 | Jan 29 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or… Affected: through 1.0.5; 1.1.0; 1.1.1 |
| CVE-2017-17688 | 5.9 | May 16 | The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL Affected: All versions, or not specified |
| CVE-2026-114726 New | 5.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-75006 | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-75000 | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-74999 | 5.4 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2020-18671 | 5.4 | Jun 24 | Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php Affected: through 1.4.4 |
| CVE-2020-18670 | 5.4 | Jun 24 | Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php Affected: 1.4.4 |
| CVE-2021-26925 | 5.4 | Feb 9 | Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering Affected: before 1.4.11 |
| CVE-2026-114731 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action) Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114729 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114728 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114714 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-35544 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-35543 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-35542 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-114725 New | 5.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114718 New | 4.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-54432 | 4.7 | Jul 14 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |