Skip to content
OpenAdvisories

Package · Debian

roundcube

123 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.2
    CVE-2025-68461 Exploited Public exploit EPSS 27%

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…

    Roundcube Webmail roundcube roundcube Debian Ubuntu
    KEV Feb 20, 2026
  • Critical 9.9
    CVE-2025-49113 Exploited Public exploit EPSS 100%

    Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist
    KEV Feb 20, 2026
  • Critical 9.3
    CVE-2024-42009 Exploited Public exploit EPSS 83%

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…

    roundcube roundcube Debian Ubuntu
    KEV Jun 9, 2025
  • Medium 6.1
    CVE-2024-37383 Exploited Public exploit EPSS 74%

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    roundcube roundcube Debian Ubuntu
    KEV Oct 24, 2024
  • Medium 6.1
    CVE-2023-43770 Exploited Public exploit EPSS 64%

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…

    roundcube roundcube Debian Ubuntu
    KEV Feb 12, 2024
  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Medium 6.1
    CVE-2020-35730 Exploited Public exploit EPSS 33%

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Medium 6.3
    CVE-2020-13965 Exploited Public exploit EPSS 77%

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…

    roundcube roundcube Debian Ubuntu
    KEV Jun 26, 2024
  • Critical 9.8
    CVE-2020-12641 Exploited Public exploit EPSS 84%

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • High 7.8
    CVE-2017-16651 Exploited Public exploit EPSS 46%

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…

    roundcube roundcube roundcubemail Debian Ubuntu Alpine
    KEV Nov 3, 2021