Roundcube known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 11 Roundcube vulnerabilities: 2 added in the last 365 days, 4 rated critical (CVSS 9 or higher), and 0 with known ransomware use. The most recent was added Feb 20, 2026.
RSS feed for Roundcube exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2026-02-20 | CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 9.9 (v3.1) | 99.7% | 2026-03-13 | Unknown |
| 2026-02-20 | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability | 7.2 (v3.1) | 27.4% | 2026-03-13 | Unknown |
| 2025-06-09 | CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting Vulnerability | 9.3 (v3.1) | 82.9% | 2025-06-30 | Unknown |
| 2024-10-24 | CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.1 (v3.1) | 74.0% | 2024-11-14 | Unknown |
| 2024-06-26 | CVE-2020-13965 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.3 (v3.1) | 76.6% | 2024-07-17 | Unknown |
| 2024-02-12 | CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 6.1 (v3.1) | 63.7% | 2024-03-04 | Unknown |
| 2023-10-26 | CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 6.1 (v3.1) | 76.3% | 2023-11-16 | Unknown |
| 2023-06-22 | CVE-2020-12641 | Roundcube Webmail Remote Code Execution Vulnerability | 9.8 (v3.1) | 84.5% | 2023-07-13 | Unknown |
| 2023-06-22 | CVE-2020-35730 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.1 (v3.1) | 32.9% | 2023-07-13 | Unknown |
| 2023-06-22 | CVE-2021-44026 | Roundcube Webmail SQL Injection Vulnerability | 9.8 (v3.1) | 69.9% | 2023-07-13 | Unknown |
| 2021-11-03 | CVE-2017-16651 | Roundcube Webmail File Disclosure Vulnerability | 7.8 (v3.1) | 45.7% | 2022-05-03 | Unknown |