Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Roundcube: actively exploited vulnerabilities

11 vulnerabilities in Roundcube products (Webmail) are in CISA’s catalog of exploited vulnerabilities. Last added: February 20, 2026.

Roundcube security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Roundcube category to your radar, or open its page.

  • Email 11 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Webmail11 vulnerabilities, Email

Name used by CISA: Roundcube. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Roundcube list.

  1. Rank 1

    Roundcube WebmailCVE-2025-49113

    RoundCube Webmail Deserialization of Untrusted Data Vulnerability

    CVSS severity 8.8high

    Added Feb 20, 2026

  2. Rank 2

    Roundcube WebmailCVE-2025-68461

    RoundCube Webmail Cross-site Scripting Vulnerability

    CVSS severity 6.1medium

    Added Feb 20, 2026

  3. Rank 3

    Roundcube WebmailCVE-2020-12641

    Roundcube Webmail Remote Code Execution Vulnerability

    CVE from 2020, added in 2023

    CVSS severity 9.8critical

    Added Jun 22, 2023

  4. Rank 4

    Roundcube WebmailCVE-2021-44026

    Roundcube Webmail SQL Injection Vulnerability

    CVE from 2021, added in 2023

    CVSS severity 9.8critical

    Added Jun 22, 2023

  5. Rank 5

    Roundcube WebmailCVE-2024-42009

    RoundCube Webmail Cross-Site Scripting Vulnerability

    CVSS severity 9.3critical

    Added Jun 9, 2025

  6. Rank 6

    Roundcube WebmailCVE-2017-16651

    Roundcube Webmail File Disclosure Vulnerability

    CVE from 2017, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  7. Rank 7

    Roundcube WebmailCVE-2024-37383

    RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

    CVSS severity 6.1medium

    Added Oct 24, 2024

  8. Rank 8

    Roundcube WebmailCVE-2020-13965

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    CVE from 2020, added in 2024

    CVSS severity 6.1medium

    Added Jun 26, 2024

  9. Rank 9

    Roundcube WebmailCVE-2023-43770

    Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

    CVSS severity 6.1medium

    Added Feb 12, 2024

  10. Rank 10

    Roundcube WebmailCVE-2020-35730

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    CVE from 2020, added in 2023

    CVSS severity 6.1medium

    Added Jun 22, 2023

Show 1 more vulnerability
  1. Rank 11

    Roundcube WebmailCVE-2023-5631

    Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

    CVSS severity 5.4medium

    Added Oct 26, 2023

Follow and verify

Get new Roundcube vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.