Cyberfeed6 › Vendors › Roundcube
CISA lists 11 Roundcube vulnerabilities as exploited in real attacks. Most entries concern Webmail, Roundcube Webmail.
Showing the 11 most recently added of 11. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2025-68461RoundCube Webmail Cross-site Scripting Vulnerability | Webmail | 2026-02-20 | High (7.2) | No | Vendor notice |
| CVE-2025-49113RoundCube Webmail Deserialization of Untrusted Data Vulnerability | Webmail | 2026-02-20 | Critical (9.9) | No | Vendor notice |
| CVE-2024-42009RoundCube Webmail Cross-Site Scripting Vulnerability | Webmail | 2025-06-09 | Critical (9.3) | No | Vendor notice |
| CVE-2024-37383RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | Webmail | 2024-10-24 | Medium (6.1) | No | Vendor notice |
| CVE-2020-13965Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Webmail | 2024-06-26 | Medium (6.3) | No | Vendor notice |
| CVE-2023-43770Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Webmail | 2024-02-12 | Medium (6.1) | No | Vendor notice |
| CVE-2023-5631Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Webmail | 2023-10-26 | Medium (6.1) | No | Vendor notice |
| CVE-2021-44026Roundcube Webmail SQL Injection Vulnerability | Roundcube Webmail | 2023-06-22 | Critical (9.8) | No | Vendor notice |
| CVE-2020-35730Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Roundcube Webmail | 2023-06-22 | Medium (6.1) | No | Vendor notice |
| CVE-2020-12641Roundcube Webmail Remote Code Execution Vulnerability | Roundcube Webmail | 2023-06-22 | Critical (9.8) | No | Vendor notice |
| CVE-2017-16651Roundcube Webmail File Disclosure Vulnerability | Roundcube Webmail | 2021-11-03 | High (7.8) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.