# cve.now: Roundcube

The newest entries naming Roundcube as an affected vendor (up to 200), of 59 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114732](https://cve.now/CVE-2026-114732.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. (CVSS 6.8)
- [CVE-2026-114731](https://cve.now/CVE-2026-114731.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy… (CVSS 5.3)
- [CVE-2026-114730](https://cve.now/CVE-2026-114730.md): Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. (CVSS 7.2)
- [CVE-2026-114729](https://cve.now/CVE-2026-114729.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. (CVSS 5.3)
- [CVE-2026-114728](https://cve.now/CVE-2026-114728.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes (CVSS 5.3)
- [CVE-2026-114727](https://cve.now/CVE-2026-114727.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. (CVSS 8.3)
- [CVE-2026-114726](https://cve.now/CVE-2026-114726.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. (CVSS 5.8)
- [CVE-2026-114725](https://cve.now/CVE-2026-114725.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. (CVSS 5.0)
- [CVE-2026-114724](https://cve.now/CVE-2026-114724.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube\_session::unserialize(). (CVSS 7.4)
- [CVE-2026-114723](https://cve.now/CVE-2026-114723.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. (CVSS 3.7)
- [CVE-2026-114722](https://cve.now/CVE-2026-114722.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. (CVSS 6.5)
- [CVE-2026-114721](https://cve.now/CVE-2026-114721.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled\_actions configuration setting to be bypassed. (CVSS 3.1)
- [CVE-2026-114720](https://cve.now/CVE-2026-114720.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. (CVSS 7.1)
- [CVE-2026-114719](https://cve.now/CVE-2026-114719.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the… (CVSS 3.7)
- [CVE-2026-114718](https://cve.now/CVE-2026-114718.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. (CVSS 4.7)
- [CVE-2026-114717](https://cve.now/CVE-2026-114717.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as… (CVSS 4.0)
- [CVE-2026-114716](https://cve.now/CVE-2026-114716.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. (CVSS 8.5)
- [CVE-2026-114715](https://cve.now/CVE-2026-114715.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of… (CVSS 6.8)
- [CVE-2026-114714](https://cve.now/CVE-2026-114714.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail\_usercopy plugin. (CVSS 5.3)
- [CVE-2026-113386](https://cve.now/CVE-2026-113386.md): Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. (CVSS 7.1)
- [CVE-2026-75010](https://cve.now/CVE-2026-75010.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication (CVSS 6.4)
- [CVE-2026-75007](https://cve.now/CVE-2026-75007.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitut (CVSS 5.4)
- [CVE-2026-75006](https://cve.now/CVE-2026-75006.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma (CVSS 5.8)
- [CVE-2026-75004](https://cve.now/CVE-2026-75004.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve\_disabled\_actions setting byp (CVSS 4.3)
- [CVE-2026-75003](https://cve.now/CVE-2026-75003.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote i (CVSS 5.8)
- [CVE-2026-75002](https://cve.now/CVE-2026-75002.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information d (CVSS 7.1)
- [CVE-2026-75000](https://cve.now/CVE-2026-75000.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remo (CVSS 5.8)
- [CVE-2026-74999](https://cve.now/CVE-2026-74999.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. (CVSS 5.4)
- [CVE-2026-74998](https://cve.now/CVE-2026-74998.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which m (CVSS 7.2)
- [CVE-2026-74997](https://cve.now/CVE-2026-74997.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd\_learn driver of the markasjunk plugin is subject to remote code execution (CVSS 8.8)
- [CVE-2026-54432](https://cve.now/CVE-2026-54432.md): Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). (CVSS 4.7)
- [CVE-2026-54433](https://cve.now/CVE-2026-54433.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message (CVSS 7.2)
- [CVE-2026-62644](https://cve.now/CVE-2026-62644.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via (CVSS 6.4)
- [CVE-2026-62643](https://cve.now/CVE-2026-62643.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma (CVSS 7.2)
- [CVE-2026-62642](https://cve.now/CVE-2026-62642.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of (CVSS 4.3)
- [CVE-2026-62641](https://cve.now/CVE-2026-62641.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF si (CVSS 4.3)
- [CVE-2026-48849](https://cve.now/CVE-2026-48849.md): In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stor (CVSS 4.4)
- [CVE-2026-48848](https://cve.now/CVE-2026-48848.md): Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS (CVSS 7.2)
- [CVE-2026-48847](https://cve.now/CVE-2026-48847.md): Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session p (CVSS 3.7)
- [CVE-2026-48846](https://cve.now/CVE-2026-48846.md): In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() v (CVSS 6.5)
- [CVE-2026-48845](https://cve.now/CVE-2026-48845.md): In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to loca (CVSS 6.5)
- [CVE-2026-48844](https://cve.now/CVE-2026-48844.md): Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lea (CVSS 7.5)
- [CVE-2026-48843](https://cve.now/CVE-2026-48843.md): Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML (CVSS 7.2)
- [CVE-2026-48842](https://cve.now/CVE-2026-48842.md): Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser\_query plugin via a preg\_re (CVSS 8.1)
- [CVE-2026-35545](https://cve.now/CVE-2026-35545.md): An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. (CVSS 5.3)
- [CVE-2026-35544](https://cve.now/CVE-2026-35544.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3)
- [CVE-2026-35543](https://cve.now/CVE-2026-35543.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3)
- [CVE-2026-35542](https://cve.now/CVE-2026-35542.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 5.3)
- [CVE-2026-35541](https://cve.now/CVE-2026-35541.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 4.2)
- [CVE-2026-35540](https://cve.now/CVE-2026-35540.md): An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. (CVSS 5.4)
- [CVE-2026-35539](https://cve.now/CVE-2026-35539.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 6.1)
- [CVE-2026-35538](https://cve.now/CVE-2026-35538.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 3.1)
- [CVE-2026-35537](https://cve.now/CVE-2026-35537.md): An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. (CVSS 3.7)
- [CVE-2026-26079](https://cve.now/CVE-2026-26079.md): Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled. (CVSS 4.7)
- [CVE-2026-25916](https://cve.now/CVE-2026-25916.md): Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. (CVSS 4.3)
- [CVE-2025-68461](https://cve.now/CVE-2025-68461.md): Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d (CVSS 7.2, KEV)
- [CVE-2025-68460](https://cve.now/CVE-2025-68460.md): Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. (CVSS 7.2)
- [CVE-2025-49113](https://cve.now/CVE-2025-49113.md): Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the \_from parameter in a (CVSS 9.9, KEV)
- [CVE-2023-5631](https://cve.now/CVE-2023-5631.md): Stored XSS vulnerability in Roundcube (CVSS 6.1, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/roundcube
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.