What’s Vulnerable › Products

Roundcube Webmail vulnerabilities

126 known vulnerabilities, 11 confirmed exploited in the wild (CISA KEV), 59 published in the last 12 months.

Check whether your Roundcube Webmail version is affected

Exploited Roundcube Webmail vulnerabilities

• CVE-2025-68461 — RoundCube Webmail Cross-site Scripting Vulnerability
• CVE-2025-49113 — RoundCube Webmail Deserialization of Untrusted Data Vulnerability
• CVE-2024-42009 — RoundCube Webmail Cross-Site Scripting Vulnerability
• CVE-2024-37383 — RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
• CVE-2020-13965 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
• CVE-2023-43770 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
• CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
• CVE-2021-44026 — Roundcube Webmail SQL Injection Vulnerability
• CVE-2020-35730 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
• CVE-2020-12641 — Roundcube Webmail Remote Code Execution Vulnerability
• CVE-2017-16651 — Roundcube Webmail File Disclosure Vulnerability

Latest Roundcube Webmail vulnerabilities

• CVE-2026-114732 — (CVSS 6.8)
• CVE-2026-114731 — (CVSS 5.3)
• CVE-2026-114730 — (CVSS 7.2)
• CVE-2026-114729 — (CVSS 5.3)
• CVE-2026-114728 — (CVSS 5.3)
• CVE-2026-114727 — (CVSS 8.3)
• CVE-2026-114726 — (CVSS 5.8)
• CVE-2026-114725 — (CVSS 5.0)
• CVE-2026-114724 — (CVSS 7.4)
• CVE-2026-114723 — (CVSS 3.7)
• CVE-2026-114722 — (CVSS 6.5)
• CVE-2026-114721 — (CVSS 3.1)
• CVE-2026-114720 — (CVSS 7.1)
• CVE-2026-114719 — (CVSS 3.7)
• CVE-2026-114718 — (CVSS 4.7)
• CVE-2026-114717 — (CVSS 4.0)
• CVE-2026-114716 — (CVSS 8.5)
• CVE-2026-114715 — (CVSS 6.8)
• CVE-2026-114714 — (CVSS 5.3)
• CVE-2026-113386 — (CVSS 7.1)
• CVE-2026-75010 — (CVSS 4.3)
• CVE-2026-75007 — (CVSS 8.8)
• CVE-2026-75006 — (CVSS 5.8)
• CVE-2026-75004 — (CVSS 4.3)
• CVE-2026-75003 — (CVSS 9.8)