CISA's list that day

20 February 2026

On CISA added 2 vulnerabilities to its list of exploited vulnerabilities, in Roundcube Webmail. US federal agencies must fix them by .

Added that day

Added that day
VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-49113Deserialization of Untrusted DataRoundcube WebmailPatch this weekMetasploit module; EPSS 0.990.99
CVE-2025-68461Cross-site ScriptingRoundcube WebmailPatch soon0.27