RO
Vendor
Roundcube
137
CVEs
16
On KEV
20
New 30D
Products
WE10.0
Webmail
Roundcube
124 CVEs11 on KEV20 new
RW9.8
Roundcube Webmail
Roundcube
11 CVEs4 on KEV0 new
RO5.4
Roundcubemail
Roundcube
1 CVEs1 on KEV0 new
RO6.1
Roundcube
Roundcube
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114732 New | WE Webmail Roundcube | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations |
| CVE-2026-114731 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action) |
| CVE-2026-114730 New | WE Webmail Roundcube | 7.2 | Oct 22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass |
| CVE-2026-114729 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass |
| CVE-2026-114728 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes |
| CVE-2026-114727 New | WE Webmail Roundcube | 8.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images |
| CVE-2026-114726 New | WE Webmail Roundcube | 5.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action |
| CVE-2026-114725 New | WE Webmail Roundcube | 5.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability |
| CVE-2026-114724 New | WE Webmail Roundcube | 7.4 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() |
| CVE-2026-114723 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation |
| CVE-2026-114722 New | WE Webmail Roundcube | 6.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages |
| CVE-2026-114721 New | WE Webmail Roundcube | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed |
| CVE-2026-114720 New | WE Webmail Roundcube | 7.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability |
| CVE-2026-114719 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin |
| CVE-2026-114718 New | WE Webmail Roundcube | 4.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin |
| CVE-2026-114717 New | WE Webmail Roundcube | 4.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment |
| CVE-2026-114716 New | WE Webmail Roundcube | 8.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability |
| CVE-2026-114715 New | WE Webmail Roundcube | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin |
| CVE-2026-114714 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin |
| CVE-2026-113386 | WE Webmail Roundcube | 7.1 | Oct 20 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection |
| CVE-2026-75010 | WE Webmail Roundcube | 4.3 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via… |
| CVE-2026-75007 | WE Webmail Roundcube | 8.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information… |
| CVE-2026-75006 | WE Webmail Roundcube | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… |
| CVE-2026-75004 | WE Webmail Roundcube | 4.3 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve… |
| CVE-2026-75003 | WE Webmail Roundcube | 9.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to… |
| CVE-2026-75002 | WE Webmail Roundcube | 7.1 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via… |
| CVE-2026-75000 | WE Webmail Roundcube | 5.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn… |
| CVE-2026-74999 | WE Webmail Roundcube | 5.4 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS |
| CVE-2026-74998 | WE Webmail Roundcube | 7.2 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or… |
| CVE-2026-74997 | WE Webmail Roundcube | 8.8 | Aug 17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement… |
| CVE-2026-54432 | WE Webmail Roundcube | 4.7 | Jul 14 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) |
| CVE-2026-54433 | WE Webmail Roundcube | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message |
| CVE-2026-62644 | WE Webmail Roundcube | 9.8 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to… |
| CVE-2026-62643 | WE Webmail Roundcube | 10.0 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information… |
| CVE-2026-62642 | WE Webmail Roundcube | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a… |
| CVE-2026-62641 | WE Webmail Roundcube | 6.5 | Jul 14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size |
| CVE-2026-48849 | WE Webmail Roundcube | 4.4 | May 25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared… |
| CVE-2026-48848 | WE Webmail Roundcube | 7.2 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that… |
| CVE-2026-48847 | WE Webmail Roundcube | 3.7 | May 25 | Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass |
| CVE-2026-48846 | WE Webmail Roundcube | 6.5 | May 25 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may… |
| CVE-2026-48845 | WE Webmail Roundcube | 6.5 | May 25 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead… |
| CVE-2026-48844 | WE Webmail Roundcube | 7.5 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection |
| CVE-2026-48843 | WE Webmail Roundcube | 7.2 | May 25 | Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or… |
| CVE-2026-48842 | WE Webmail Roundcube | 8.1 | May 25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass |
| CVE-2026-35545 | WE Webmail Roundcube | 8.2 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15 |
| CVE-2026-35544 | WE Webmail Roundcube | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35543 | WE Webmail Roundcube | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35542 | WE Webmail Roundcube | 5.3 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35541 | WE Webmail Roundcube | 4.2 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35540 | WE Webmail Roundcube | 6.5 | Apr 3 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14 |
| CVE-2026-35539 | WE Webmail Roundcube | 6.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35538 | WE Webmail Roundcube | 3.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2026-35537 | WE Webmail Roundcube | 7.5 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 |
| CVE-2025-68460 | WE Webmail Roundcube | 7.5 | Dec 18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer |
| CVE-2025-68461 In wildKEV | WE Webmail Roundcube | 6.1 | Dec 18 | RoundCube Webmail Cross-site Scripting Vulnerability |
| CVE-2025-49113 In wildKEV | WE Webmail Roundcube | 8.8 | Jun 2 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability |
| CVE-2024-57004 | WE Webmail Roundcube | 6.1 | Feb 3 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering… |
| CVE-2024-42008 | WE Webmail Roundcube | 9.3 | Aug 5 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a… |
| CVE-2024-42009 In wildKEV | WE Webmail Roundcube | 9.3 | Aug 5 | RoundCube Webmail Cross-Site Scripting Vulnerability |
| CVE-2024-37385 | WE Webmail Roundcube | 9.8 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path |