Skip to content
OpenAdvisories

Package · Packagist

roundcube/roundcubemail

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-35538

    Roundcube Webmail: Unsanitized IMAP SEARCH command arguments

    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist
  • Low 3.7
    CVE-2026-35537

    Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

    An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist