WE
Product
Webmail
On CISA KEVExploited in the wild
124
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 56Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44026 In wildKEV | 9.8 | Nov 19 | Roundcube Webmail SQL Injection Vulnerability Affected: before 1.3.17; 1.4.0 before 1.4.12 |
| CVE-2020-12641 In wildKEV | 9.8 | May 4 | Roundcube Webmail Remote Code Execution Vulnerability Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4 |
| CVE-2024-42009 In wildKEV | 9.3 | Aug 5 | RoundCube Webmail Cross-Site Scripting Vulnerability Affected: before 1.5.8; 1.6.0 before 1.6.8 |
| CVE-2026-54433 | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-62643 | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2026-75003 | 9.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to… Affected: 1.6.0 before 1.6.18; 1.7.0 before 1.7.3 |
| CVE-2026-62644 | 9.8 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to… Affected: 1.6.0 before 1.6.17; 1.7.0 before 1.7.2 |
| CVE-2024-37385 | 9.8 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2020-12640 | 9.8 | May 4 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php Affected: 1.2.0 before 1.2.10; 1.3.0 before 1.3.11; 1.4.0 before 1.4.4 |
| CVE-2024-42008 | 9.3 | Aug 5 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a… Affected: before 1.5.8; 1.6.0 before 1.6.8 |
Showing 10