WE
Product
Webmail
On CISA KEVExploited in the wild
124
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 56Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114723 New | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-114719 New | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-48847 | 3.7 | May 25 | Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass Affected: 1.6.0 before 1.6.16; 1.7.0 before 1.7.1 |
| CVE-2026-114721 New | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-35538 | 3.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
Showing 5