Vendor
Roundcube
As of , 11 Roundcube vulnerabilities are on CISA's list of exploited vulnerabilities; 2 were added in 2026. Patch first: CVE-2025-49113.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-49113Deserialization of Untrusted Data | Roundcube Webmail | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 2 | CVE-2017-16651File Disclosure | Roundcube Roundcube Webmail | Patch this weekMetasploit module | 0.46 | ||
| 3 | CVE-2024-42009Cross-Site Scripting | Roundcube Webmail | Patch this weekEPSS 0.83 | 0.83 | ||
| 4 | CVE-2024-37383Cross-Site Scripting (XSS) | Roundcube Webmail | Patch this weekEPSS 0.73 | 0.73 | ||
| 5 | CVE-2020-13965Cross-Site Scripting (XSS) | Roundcube Webmail | Patch this weekEPSS 0.77 | 0.77 | ||
| 6 | CVE-2023-43770Persistent Cross-Site Scripting (XSS) | Roundcube Webmail | Patch this weekEPSS 0.64 | 0.64 | ||
| 7 | CVE-2023-5631Persistent Cross-Site Scripting (XSS) | Roundcube Webmail | Patch this weekEPSS 0.76 | 0.76 | ||
| 8 | CVE-2020-12641Remote Code Execution | Roundcube Roundcube Webmail | Patch this weekEPSS 0.84 | 0.84 | ||
| 9 | CVE-2021-44026SQL Injection | Roundcube Roundcube Webmail | Patch this weekEPSS 0.70 | 0.70 | ||
| 10 | CVE-2020-35730Cross-Site Scripting (XSS) | Roundcube Roundcube Webmail | Patch soon | 0.33 | ||
| 11 | CVE-2025-68461Cross-site Scripting | Roundcube Webmail | Patch soon | 0.27 |
Products
- Webmail7 entries
- Roundcube Webmail4 entries
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 1 |
| 2022 | none |
| 2023 | 4 |
| 2024 | 3 |
| 2025 | 1 |
| 2026 | 2 |