Product by Roundcube
Roundcube Webmail
126 known vulnerabilities in Roundcube Webmail (Roundcube), 11 of them actively exploited (CISA KEV).
Key figures
126
Vulnerabilities
11
Actively exploited (KEV)
0
Used by ransomware
18
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability In CISA KEValso in 2 other products | 9.9 | |
| Critical | CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting Vulnerability In CISA KEValso in 1 other product | 9.3 | |
| Critical | CVE-2020-12641 | Roundcube Webmail Remote Code Execution Vulnerability In CISA KEValso in 2 other products | 9.8 | |
| Critical | CVE-2021-44026 | Roundcube Webmail SQL Injection Vulnerability In CISA KEValso in 3 other products | 9.8 | |
| Critical | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability In CISA KEValso in 3 other products | 7.2 | |
| Critical | CVE-2017-16651 | Roundcube Webmail File Disclosure Vulnerability In CISA KEValso in 1 other product | 7.8 | |
| Critical | CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability In CISA KEValso in 2 other products | 6.1 | |
| Critical | CVE-2023-5631 | Stored XSS vulnerability in Roundcube In CISA KEValso in 3 other products | 6.1 | |
| Critical | CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability In CISA KEValso in 1 other product | 6.1 | |
| Critical | CVE-2020-13965 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability In CISA KEValso in 2 other products | 6.1 | |
| Critical | CVE-2020-35730 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability In CISA KEValso in 3 other products | 6.1 | |
| Critical | CVE-2024-42008 | Roundcube Webmail: Cross-Site Scripting (XSS) | 9.3 | |
| Critical | CVE-2020-12640 | Roundcube Webmail: Path Traversal | 9.8 | |
| Medium | CVE-2024-57004 | Roundcube Webmail: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-75002 | Roundcube Webmail: Command Injection | 7.1 | |
| High | CVE-2015-2180 | Roundcube Webmail: security vulnerability | 8.8 | |
| Medium | CVE-2018-19206 | Roundcube Webmail: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2017-8114 | Roundcube Webmail: security vulnerability | 8.8 | |
| High | CVE-2016-9920 | Roundcube Webmail: Code Execution | 7.5 | |
| High | CVE-2026-48842 | Roundcube Webmail: SQL Injection | 8.1 | |
| High | CVE-2015-2181 | Roundcube Webmail: Buffer Overflow | 8.8 | |
| High | CVE-2016-4069 | Roundcube Webmail: Cross-Site Request Forgery (CSRF) | 8.8 | |
| High | CVE-2015-5383 | Roundcube Webmail: Information Disclosure | 7.5 | |
| High | CVE-2018-9846 | Roundcube Webmail: security vulnerability | 8.8 | |
| Medium | CVE-2017-17688 | Apple Mail for iPhone OS: security vulnerability | 5.9 |
News
- Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wildthehackernews,
- Roundcube Webmail Vulnerability in Attackers’ Crosshairssecurityweek,
- ta458 roundpress exploitsproofpoint-threat-insight,
- Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universitiesthehackernews,
- Threat Actors Target US and Canadian University Research Physicists Through Roundcube Vulnerabilitiessans-newsbites-mail,