WE
Product
Webmail
On CISA KEVExploited in the wild
126
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 58Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48846 | 6.5 | May 25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may… Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-48845 | 6.5 | May 25 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead… Affected: 1.6.14 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-35540 | 6.5 | Apr 3 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14 Affected: 1.6.0 before 1.6.14 |
| CVE-2020-12626 | 6.5 | May 4 | An issue was discovered in Roundcube Webmail before 1.4.4 Affected: before 1.4.4 |
| CVE-2015-5382 | 6.5 | May 23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when… Affected: 1.1; 1.1; 1.1 |
| CVE-2026-35539 | 6.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2024-57004 | 6.1 | Feb 3 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering… Affected: 1.6.9 |
| CVE-2024-37384 | 6.1 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2023-47272 | 6.1 | Nov 6 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download) Affected: 1.5.0 before 1.5.6; 1.6.0 before 1.6.5 |
| CVE-2021-44025 | 6.1 | Nov 19 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message Affected: before 1.3.17; 1.4.0 before 1.4.12 |
| CVE-2020-16145 | 6.1 | Aug 12 | Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document Affected: before 1.3.15; 1.4.0 before 1.4.8 |
| CVE-2020-15562 | 6.1 | Jul 6 | An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7 Affected: before 1.2.11; 1.3.0 before 1.3.14; 1.4.0 before 1.4.7 |
| CVE-2020-13964 | 6.1 | Jun 9 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5 Affected: before 1.3.12; 1.4.0 before 1.4.5 |
| CVE-2020-12625 | 6.1 | May 4 | An issue was discovered in Roundcube Webmail before 1.4.4 Affected: before 1.4.4 |
| CVE-2018-19206 | 6.1 | Nov 12 | steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment Affected: before 1.3.8 |
| CVE-2015-5381 | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.1; 1.1; 1.1 |
| CVE-2016-4068 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: through 1.0.8; 1.1; 1.1; 1.1; 1.1.4 |
| CVE-2015-8864 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: through 1.0.8; 1.1; 1.1; 1.1; 1.1.4 |
| CVE-2017-6820 | 6.1 | Mar 12 | rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence… Affected: through 1.1.7; 1.2.0; 1.2.1; 1.2.2; 1.2.3 |
| CVE-2016-4552 | 6.1 | Dec 20 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in… Affected: 1.2 |
| CVE-2015-8793 | 6.1 | Jan 29 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or… Affected: through 1.0.5; 1.1.0; 1.1.1 |
| CVE-2017-17688 | 5.9 | May 16 | The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL Affected: All versions, or not specified |
| CVE-2026-114726 New | 5.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-75006 | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-75000 | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-74999 | 5.4 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2020-18671 | 5.4 | Jun 24 | Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php Affected: through 1.4.4 |
| CVE-2020-18670 | 5.4 | Jun 24 | Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php Affected: 1.4.4 |
| CVE-2021-26925 | 5.4 | Feb 9 | Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering Affected: before 1.4.11 |
| CVE-2026-114731 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action) Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114729 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114728 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114714 New | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-35544 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-35543 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-35542 | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-114725 New | 5.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114718 New | 4.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-54432 | 4.7 | Jul 14 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-26079 | 4.7 | Feb 11 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled Affected: before 1.5.13; 1.6.0 before 1.6.13 |
| CVE-2026-48849 | 4.4 | May 25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared… Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-75010 | 4.3 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-75004 | 4.3 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-25916 | 4.3 | Feb 9 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage Affected: before 1.5.13; 1.6.0 before 1.6.13 |
| CVE-2019-10740 | 4.3 | Apr 7 | In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email Affected: before 1.3.10 |
| CVE-2026-35541 | 4.2 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2026-114717 New | 4.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114723 New | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114719 New | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-48847 | 3.7 | May 25 | Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |