By year
05
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Roundcube flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-68461 RoundCube Webmail Cross-site ScriptingExploited since Feb 20, 2026 · CVSS 7.2
- CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted DataExploited since Feb 20, 2026 · CVSS 9.9
- CVE-2024-42009 RoundCube Webmail Cross-Site ScriptingExploited since Jun 9, 2025 · CVSS 9.3
- CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS)Exploited since Oct 24, 2024 · CVSS 6.1
- CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS)Exploited since Jun 26, 2024 · CVSS 6.1
- CVE-2023-43770 Roundcube Webmail Persistent Cross-Site Scripting (XSS)Exploited since Feb 12, 2024 · CVSS 6.1
- CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS)Exploited since Oct 26, 2023 · CVSS 6.1
- CVE-2021-44026 Roundcube Webmail SQL InjectionExploited since Jun 22, 2023 · CVSS 9.8
- CVE-2020-35730 Roundcube Webmail Cross-Site Scripting (XSS)Exploited since Jun 22, 2023 · CVSS 6.1
- CVE-2020-12641 Roundcube Webmail Remote Code ExecutionExploited since Jun 22, 2023 · CVSS 9.8
- CVE-2017-16651 Roundcube Webmail File DisclosureExploited since Nov 3, 2021 · CVSS 7.8
Latest high and critical flaws
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.High 7.2 · Oct 21, 2026
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().High 7.4 · Oct 21, 2026
- CVE-2025-68461 RoundCube Webmail Cross-site ScriptingExploited · High 7.2 · Dec 18, 2025
- CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted DataExploited · Critical 9.9 · Jun 2, 2025
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messageHigh 7.5 · Aug 5, 2024
- CVE-2024-42009 RoundCube Webmail Cross-Site ScriptingExploited · Critical 9.3 · Aug 5, 2024
- CVE-2024-42008 A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and sCritical 9.3 · Aug 5, 2024
- CVE-2024-37385 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.Critical 9.8 · Jun 7, 2024
- CVE-2021-44026 Roundcube Webmail SQL InjectionExploited · Critical 9.8 · Nov 18, 2021
- CVE-2020-12641 Roundcube Webmail Remote Code ExecutionExploited · Critical 9.8 · May 4, 2020
- CVE-2020-12640 Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.Critical 9.8 · May 4, 2020
- CVE-2019-15237 Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.High 7.4 · Aug 19, 2019
- CVE-2018-19205 Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue High 7.5 · Nov 12, 2018
- CVE-2018-9846 In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" paraHigh 8.8 · Apr 7, 2018
- CVE-2018-1000071 roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key.High 7.5 · Mar 13, 2018
- CVE-2017-16651 Roundcube Webmail File DisclosureExploited · High 7.8 · Nov 9, 2017
- CVE-2015-5383 Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directoryHigh 7.5 · May 23, 2017
- CVE-2017-8114 Roundcube Webmail allows arbitrary password resets by authenticated users.High 8.8 · Apr 29, 2017
- CVE-2015-2181 Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) paHigh 8.8 · Jan 30, 2017
- CVE-2015-2180 The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the passworHigh 8.8 · Jan 30, 2017
- CVE-2016-9920 steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properHigh 7.5 · Dec 8, 2016
- CVE-2015-8770 Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remHigh 7.5 · Jan 29, 2016
- CVE-2013-6172 steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parHigh 7.5 · Nov 5, 2013
- CVE-2008-5620 RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that areHigh 7.8 · Dec 16, 2008
- CVE-2008-5619 html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, andHigh 10 · Dec 16, 2008
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.