Critical 1 exploited CVE DSA-5013-1 2 CVEs

roundcube - security update

Published Nov 27, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 10	roundcube	1.3.17+dfsg.1-1~deb10u1
Debian · 11	roundcube	1.4.12+dfsg.1-1~deb11u1

Vulnerabilities 2

Critical 9.8

CVE-2021-44026 Exploited Public exploit EPSS 70%

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

roundcube roundcube Debian Ubuntu

Nov 19, 2021
KEV Jun 22, 2023
Unscored —

CVE-2021-44025

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when dis…

roundcube roundcube Debian Ubuntu

Nov 19, 2021