{"meta":{"title":"KEV entries: Roundcube","description":"All KEV entries for vendor Roundcube.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":11,"vendor":"Roundcube","entries":11,"shareOfCatalogPercent":0.6,"ransomwareKnown":0,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-02-20","rank":26},"data":[{"cveID":"CVE-2025-68461","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"RoundCube Webmail Cross-site Scripting Vulnerability","dateAdded":"2026-02-20","dueDate":"2026-03-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 ; https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb ; https://nvd.nist.gov/vuln/detail/CVE-2025-68461","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-68461"},{"cveID":"CVE-2025-49113","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-02-20","dueDate":"2026-03-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.5.10 ; https://github.com/roundcube/roundcubemail/releases/tag/1.6.11 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49113","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-49113"},{"cveID":"CVE-2024-42009","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"RoundCube Webmail Cross-Site Scripting Vulnerability","dateAdded":"2025-06-09","dueDate":"2025-06-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-42009","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-42009"},{"cveID":"CVE-2024-37383","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2024-10-24","dueDate":"2024-11-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.7, https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 ; https://nvd.nist.gov/vuln/detail/CVE-2024-37383","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-37383"},{"cveID":"CVE-2020-13965","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2024-06-26","dueDate":"2024-07-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-80"],"shortDescription":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12; https://nvd.nist.gov/vuln/detail/CVE-2020-13965","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2020-13965"},{"cveID":"CVE-2023-43770","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2024-02-12","dueDate":"2024-03-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ;  https://nvd.nist.gov/vuln/detail/CVE-2023-43770","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-43770"},{"cveID":"CVE-2023-5631","vendorProject":"Roundcube","product":"Webmail","vulnerabilityName":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2023-10-26","dueDate":"2023-11-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-5631","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-5631"},{"cveID":"CVE-2021-44026","vendorProject":"Roundcube","product":"Roundcube Webmail","vulnerabilityName":"Roundcube Webmail SQL Injection Vulnerability","dateAdded":"2023-06-22","dueDate":"2023-07-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"Roundcube Webmail is vulnerable to SQL injection via search or search_params.","requiredAction":"Apply updates per vendor instructions.","notes":"https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released; https://nvd.nist.gov/vuln/detail/CVE-2021-44026","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-44026"},{"cveID":"CVE-2020-35730","vendorProject":"Roundcube","product":"Roundcube Webmail","vulnerabilityName":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2023-06-22","dueDate":"2023-07-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.","requiredAction":"Apply updates per vendor instructions.","notes":"https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13; https://nvd.nist.gov/vuln/detail/CVE-2020-35730","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2020-35730"},{"cveID":"CVE-2020-12641","vendorProject":"Roundcube","product":"Roundcube Webmail","vulnerabilityName":"Roundcube Webmail Remote Code Execution Vulnerability","dateAdded":"2023-06-22","dueDate":"2023-07-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.","requiredAction":"Apply updates per vendor instructions.","notes":"https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2020-12641"},{"cveID":"CVE-2017-16651","vendorProject":"Roundcube","product":"Roundcube Webmail","vulnerabilityName":"Roundcube Webmail File Disclosure Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-552"],"shortDescription":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-16651"}]}