Product by Open Source
Roundcube
32 known vulnerabilities in Roundcube (Open Source), 1 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability In CISA KEValso in 3 other products | 7.2 | |
| High | CVE-2026-75002 | Roundcube Webmail: Command Injection | 7.1 | |
| High | CVE-2026-48842 | Roundcube Webmail: SQL Injection | 8.1 | |
| High | CVE-2026-113386 | Roundcube Webmail: CRLF Injection | 7.1 | |
| High | CVE-2026-74997 | Roundcube Webmail: OS Command Injection | 8.8 | |
| Critical | CVE-2026-54433 | Roundcube Webmail: Cross-site Scripting | 10.0 | |
| High | CVE-2026-74998 | Roundcube Webmail: Cross-site Scripting | 7.2 | |
| High | CVE-2026-48844 | Roundcube Webmail: Always-Incorrect Control Flow Implementation | 7.5 | |
| Medium | CVE-2026-75000 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.8 | |
| Medium | CVE-2026-75006 | Roundcube Webmail: Server-Side Request Forgery (SSRF) | 5.8 | |
| High | CVE-2026-48848 | Roundcube Webmail: Cross-site Scripting | 7.2 | |
| Critical | CVE-2026-75003 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.8 | |
| Medium | CVE-2026-48846 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 6.5 | |
| Medium | CVE-2026-75010 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 6.4 | |
| Medium | CVE-2026-48845 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 6.5 | |
| High | CVE-2026-75007 | Roundcube Webmail: Command Injection | 5.4 | |
| High | CVE-2026-48843 | Roundcube Webmail: Server-Side Request Forgery (SSRF) | 7.2 | |
| Low | CVE-2026-48847 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 3.7 | |
| Medium | CVE-2026-35542 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.3 | |
| Medium | CVE-2026-74999 | Roundcube Webmail: Cross-site Scripting | 5.4 | |
| Medium | CVE-2026-35543 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.3 | |
| High | CVE-2025-68460 | Roundcube Webmail: Improper Encoding or Escaping of Output | 7.2 | |
| Medium | CVE-2026-35540 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.4 | |
| High | CVE-2026-35545 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.3 | |
| Medium | CVE-2026-35544 | Roundcube Webmail: Incorrect Resource Transfer Between Spheres | 5.3 |