Vendor dossier / #26
Roundcube vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 11 Roundcube vulnerabilities as of catalog 2026.09.23, 0.6% of all 1,721 entries and rank 26 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-02-20; 0 are flagged as used in ransomware campaigns.
- KEV entries
- 110.6% of catalog
- Last 90 days
- +0added
- Ransomware: known
- 00%
- Products
- 2distinct
- First added
- 2021-11-03
- Latest added
- 2026-02-20
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 1 |
| 2022 | 0 |
| 2023 | 4 |
| 2024 | 3 |
| 2025 | 1 |
| 2026 | 2 |
QCommon questions
How many Roundcube vulnerabilities are in CISA KEV?
11, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.6% of the catalog.
Which Roundcube product has the most KEV entries?
Webmail, with 7 entries. 2 products appear in total.
How many Roundcube KEV vulnerabilities are linked to ransomware?
0 of 11 (0%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Roundcube vulnerability added to KEV?
2026-02-20 (CVE-2025-68461).
What is the most common weakness in Roundcube KEV entries?
CWE-79 (Cross-site scripting (XSS)), listed on 6 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Webmail | 7 | 63.6% |
| Roundcube Webmail | 4 | 36.4% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-79 Cross-site scripting (XSS) | 6 | 54.5% |
| CWE-502 Unsafe deserialization | 1 | 9.1% |
| CWE-80 | 1 | 9.1% |
| CWE-89 SQL injection | 1 | 9.1% |
| CWE-78 OS command injection | 1 | 9.1% |
| CWE-552 | 1 | 9.1% |
EAll 11 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2025-68461 | Webmail | RoundCube Webmail Cross-site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2025-49113 | Webmail | RoundCube Webmail Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-42009 | Webmail | RoundCube Webmail Cross-Site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-37383 | Webmail | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2020-13965 | Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-80 | ||
| CVE-2023-43770 | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2023-5631 | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2021-44026 | Roundcube Webmail | Roundcube Webmail SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2020-35730 | Roundcube Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2020-12641 | Roundcube Webmail | Roundcube Webmail Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2017-16651 | Roundcube Webmail | Roundcube Webmail File Disclosure Vulnerability | Unknown | CWE-552 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 11 Roundcube vulnerabilities (0.6% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/roundcube/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Roundcube beyond this data.