ZeusQA
Start free

Known exploited vulnerabilities

Roundcube vulnerabilities attackers have used

Every Roundcube vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 11 Roundcube vulnerabilities as exploited in the wild, 2 of them added in the last 12 months. The most recent is CVE-2025-68461, added Feb 20, 2026. Webmail has the most entries (7).

In KEV, all time
11
Added, last 12 months
2
Used in ransomware
0
New CVEs this week
0

By product

Webmail (7), Roundcube Webmail (4).

Every Roundcube entry in CISA KEV

  1. CVE-2025-68461

    Added · due

    RoundCube Webmail Cross-site Scripting Vulnerability

    RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

  2. CVE-2025-49113

    Added · due

    RoundCube Webmail Deserialization of Untrusted Data Vulnerability

    RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

  3. CVE-2024-42009

    Added · due

    RoundCube Webmail Cross-Site Scripting Vulnerability

    RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in…

  4. CVE-2024-37383

    Added · due

    RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

    RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

  5. CVE-2020-13965

    Added · due

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.

  6. CVE-2023-43770

    Added · due

    Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

  7. CVE-2023-5631

    Added · due

    Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.

  8. CVE-2021-44026

    Added · due

    Roundcube Webmail SQL Injection Vulnerability

    Roundcube Webmail is vulnerable to SQL injection via search or search_params.

  9. CVE-2020-35730

    Added · due

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in…

  10. CVE-2020-12641

    Added · due

    Roundcube Webmail Remote Code Execution Vulnerability

    Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

  11. CVE-2017-16651

    Added · due

    Roundcube Webmail File Disclosure Vulnerability

    Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works