| CVE-2026-35540 |
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14
|
5.4
Medium
|
Apr 3, 2026 |
| CVE-2026-35539 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
6.1
Medium
|
Apr 3, 2026 |
| CVE-2026-35538 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
3.1
Low
|
Apr 3, 2026 |
| CVE-2026-35537 |
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14
|
3.7
Low
|
Apr 3, 2026 |
| CVE-2026-26079 |
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because…
|
4.7
Medium
|
Feb 11, 2026 |
| CVE-2026-25916 |
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage
|
4.3
Medium
|
Feb 9, 2026 |
| CVE-2025-68461 |
Exploited
RoundCube Webmail Cross-site Scripting Vulnerability
|
7.2
High
|
Dec 18, 2025 |
| CVE-2025-68460 |
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML…
|
7.2
High
|
Dec 18, 2025 |
| CVE-2025-49113 |
Exploited
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
|
9.9
Critical
|
Jun 2, 2025 |
| CVE-2024-37383 |
Exploited
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
|
6.1
Medium
|
Jun 7, 2024 |
| CVE-2023-43770 |
Exploited
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
|
6.1
Medium
|
Sep 22, 2023 |
| CVE-2020-13965 |
Exploited
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
|
6.3
Medium
|
Jun 9, 2020 |