Advisories · Technology

Roundcube Webmail.

Every CVE that names Roundcube Webmail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114732 CVE record

CVSS 6.8 Medium

Authentication bypass in Roundcube Webmail
- Roundcube Webmail
- Authentication bypass
Not analysed yet 22 Oct 2026
CVE-2026-114731 CVE record

CVSS 5.3 Medium

Resource allocation without limits in Roundcube Webmail
- Roundcube Webmail
- Denial of service
Not analysed yet 22 Oct 2026
CVE-2026-114730 CVE record

CVSS 7.2 High

Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
Not analysed yet 22 Oct 2026
CVE-2026-114729 CVE record

CVSS 5.3 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content…
- Roundcube Webmail
- CWE-184
Not analysed yet 22 Oct 2026
CVE-2026-114728 CVE record

CVSS 5.3 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content…
- Roundcube Webmail
- CWE-184
Not analysed yet 22 Oct 2026
CVE-2026-114727 CVE record

CVSS 8.3 High

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content…
- Roundcube Webmail
- CWE-829
Not analysed yet 22 Oct 2026
CVE-2026-114726 CVE record

CVSS 5.8 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
Not analysed yet 22 Oct 2026
CVE-2026-114725 CVE record

CVSS 5.0 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
Not analysed yet 22 Oct 2026
CVE-2026-114724 CVE record

CVSS 7.4 High

Deserialization of untrusted data in Roundcube Webmail
- Roundcube Webmail
- Insecure deserialization
Not analysed yet 22 Oct 2026
CVE-2026-114723 CVE record

CVSS 3.7 Low

Resource allocation without limits in Roundcube Webmail
- Roundcube Webmail
- Denial of service
Not analysed yet 22 Oct 2026
CVE-2026-114722 CVE record

CVSS 6.5 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping…
- Roundcube Webmail
- CWE-669
Not analysed yet 22 Oct 2026
CVE-2026-114721 CVE record

CVSS 3.1 Low

Incorrect authorization in Roundcube Webmail
- Roundcube Webmail
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-114720 CVE record

CVSS 7.1 High

CRLF injection in Roundcube Webmail
- Roundcube Webmail
- Other injection
Not analysed yet 22 Oct 2026
CVE-2026-114719 CVE record

CVSS 3.7 Low

Cross-site request forgery in Roundcube Webmail
- Roundcube Webmail
- Cross-site request forgery (CSRF)
Not analysed yet 22 Oct 2026
CVE-2026-114718 CVE record

CVSS 4.7 Medium

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-114717 CVE record

CVSS 4.0 Medium

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
Not analysed yet 22 Oct 2026
CVE-2026-114716 CVE record

CVSS 8.5 High

Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
Not analysed yet 22 Oct 2026
CVE-2026-114715 CVE record

CVSS 6.8 Medium

Incorrect authorization in Roundcube Webmail
- Roundcube Webmail
- Broken access control
Not analysed yet 22 Oct 2026
CVE-2026-114714 CVE record

CVSS 5.3 Medium

Path traversal in Roundcube Webmail
- Roundcube Webmail
- Path traversal
Not analysed yet 22 Oct 2026
CVE-2026-113386 CVE record

CVSS 7.1 High

CRLF injection in Roundcube Webmail
- Roundcube Webmail
- Other injection
Not analysed yet 20 Oct 2026
CVE-2026-75010 CVE record

CVSS 6.4 Medium

Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
Not analysed yet 17 Aug 2026
CVE-2026-75007 CVE record

CVSS 5.4 Medium

Command injection in Roundcube Webmail
- Roundcube Webmail
- Command injection
Not analysed yet 17 Aug 2026
CVE-2026-75006 CVE record

CVSS 5.8 Medium

Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
Not analysed yet 17 Aug 2026
CVE-2026-75004 CVE record

CVSS 4.3 Medium

Command injection in Roundcube Webmail
- Roundcube Webmail
- Command injection
Not analysed yet 17 Aug 2026
CVE-2026-75003 CVE record

CVSS 5.8 Medium

Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
Not analysed yet 17 Aug 2026
CVE-2026-75002 CVE record

CVSS 7.1 High

Command injection in Roundcube Webmail
- Roundcube Webmail
- Command injection
Not analysed yet 17 Aug 2026
CVE-2026-75000 CVE record

CVSS 5.8 Medium

Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
Not analysed yet 17 Aug 2026
CVE-2026-74999 CVE record

CVSS 5.4 Medium

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 17 Aug 2026
CVE-2026-74998 CVE record

CVSS 7.2 High

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 17 Aug 2026
CVE-2026-74997 CVE record

CVSS 8.8 High

OS command injection in Roundcube Webmail
- Roundcube Webmail
- Command injection
Not analysed yet 17 Aug 2026
CVE-2026-54432 CVE record

CVSS 4.7 Medium

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-54433 CVE record

CVSS 7.2 High

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-62644 CVE record

CVSS 6.4 Medium

Authentication bypass by spoofing in Roundcube Webmail
- Roundcube Webmail
- Authentication bypass
Not analysed yet 14 Jul 2026
CVE-2026-62643 CVE record

CVSS 7.2 High

Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
Not analysed yet 14 Jul 2026
CVE-2026-62642 CVE record

CVSS 4.3 Medium

Infinite loop in Roundcube Webmail
- Roundcube Webmail
- Denial of service
Not analysed yet 14 Jul 2026
CVE-2026-62641 CVE record

CVSS 4.3 Medium

Resource allocation without limits in Roundcube Webmail
- Roundcube Webmail
- Denial of service
Not analysed yet 14 Jul 2026
CVE-2026-48849 CVE record

CVSS 4.4 Medium

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 25 May 2026
CVE-2026-48848 CVE record

CVSS 7.2 High

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 25 May 2026
CVE-2026-48847 CVE record

CVSS 3.7 Low

Roundcube Webmail: Roundcube Webmail 1.6.x before 1.6.16…
- Roundcube Webmail
- CWE-669
Not analysed yet 25 May 2026
CVE-2026-48846 CVE record

CVSS 6.5 Medium

Roundcube Webmail: In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1…
- Roundcube Webmail
- CWE-669
Not analysed yet 25 May 2026
CVE-2026-48845 CVE record

CVSS 6.5 Medium

Roundcube Webmail: In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1…
- Roundcube Webmail
- CWE-669
Not analysed yet 25 May 2026
CVE-2026-48844 CVE record

CVSS 7.5 High

Roundcube Webmail: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation…
- Roundcube Webmail
- CWE-670
Not analysed yet 25 May 2026
CVE-2026-48843 CVE record

CVSS 7.2 High

Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
Not analysed yet 25 May 2026
CVE-2026-48842 CVE record

CVSS 8.1 High

SQL injection in Roundcube Webmail
- Roundcube Webmail
- SQL injection
Not analysed yet 25 May 2026
CVE-2026-26079 CVE record

CVSS 4.7 Medium

Roundcube Webmail: Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)…
- Roundcube Webmail
- CWE-829
Not analysed yet 11 Feb 2026
CVE-2026-25916 CVE record

CVSS 4.3 Medium

Roundcube Webmail: Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13…
- Roundcube Webmail
- CWE-420
Not analysed yet 9 Feb 2026
CVE-2025-68461 CVE record

CVSS 7.2 HighCritical · KEV, CVSS 7+ and EPSSKEV

Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
Not analysed yet 18 Dec 2025
CVE-2025-68460 CVE record

CVSS 7.2 High

Improper output encoding in Roundcube Webmail
- Roundcube Webmail
- CWE-116
Not analysed yet 18 Dec 2025