Roundcube known exploited vulnerabilities
Every Roundcube CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 11 in all, 2 added in the last 12 months.
- CVE-2025-68461Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dRoundcube Webmail
- CVE-2025-49113Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in aRoundcube Webmail · roundcube/roundcubemail
- CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of
- CVE-2024-37383Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- CVE-2020-13965An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.
- CVE-2023-43770Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of
- CVE-2023-5631Stored XSS vulnerability in RoundcubeRoundcubemail
- CVE-2021-44026Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- CVE-2020-35730An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.
- CVE-2020-12641rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set
- CVE-2017-16651Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many Roundcube vulnerabilities are in CISA KEV?
11 Roundcube vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 2 of them added in the last 12 months. The newest is CVE-2025-68461 (RoundCube Webmail Cross-site Scripting Vulnerability), added 2026-02-20.
Which Roundcube products are in CISA KEV?
2 products, including Webmail, Roundcube Webmail. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Roundcube KEV vulnerabilities used by ransomware?
CISA has no known ransomware use on record for Roundcube's KEV entries.