Product · KEV exposure
Roundcube Webmail known exploited vulnerabilities
We track 12 CVEs in Roundcube Webmail. 11 of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2021). The most recent is CVE-2026-48842.
- CVEs tracked
- 12
- On CISA KEV
- 11
- Ransomware use
- 0
- Rated critical
- 4
Every Roundcube Webmail CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-48842 Pre-auth SQL injection in Roundcube Webmail virtuser_query pluginwrite-up | [ HIGH ] | 8.1 | 0.9% | — | — |
| CVE-2025-68461 RoundCube Webmail Cross-site Scripting Vulnerability | [ HIGH ] | 7.2 | 26.8% | ||
| CVE-2025-49113 Roundcube post-auth RCE via PHP object deserialization in upload handlerwrite-up | [ CRITICAL ] | 9.9 | 99.0% | ||
| CVE-2024-42009 Roundcube stored XSS via crafted email runs attacker JavaScript in mailboxwrite-up | [ CRITICAL ] | 9.3 | 82.9% | ||
| CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 73.3% | ||
| CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 76.6% | ||
| CVE-2023-43770 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 63.7% | ||
| CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 76.9% | ||
| CVE-2021-44026 Roundcube Webmail SQL Injection Vulnerability | [ CRITICAL ] | 9.8 | 69.9% | ||
| CVE-2020-35730 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | [ MEDIUM ] | 6.1 | 32.9% | ||
| CVE-2020-12641 Roundcube Webmail Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 84.5% | ||
| CVE-2017-16651 Roundcube Webmail File Disclosure Vulnerability | [ HIGH ] | 7.8 | 45.7% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/roundcube.json.
Our Roundcube Webmail coverage
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.