- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 1 critical, 7 medium, 2 low
- Registry
- Packagist
Advisories 10
- CVE-2026-35545Medium 5.3
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35544Medium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35543Medium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35542Medium 5.3
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35541Medium 4.2
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35540Medium 5.4
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35539Medium 6.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35538Low 3.1
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2026-35537Low 3.7
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.
Affected: from 1.7-beta, fixed in 1.7-rc5.
- CVE-2025-49113Critical 9.9 · KEV
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a
Affected: fixed in 1.5.10; from 1.6.0, fixed in 1.6.11.