Product of Roundcube

Roundcube Webmail

As of , 4 Roundcube Webmail vulnerabilities are on CISA's list of exploited vulnerabilities; 0 were added in 2026. Patch first: CVE-2017-16651.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2017-16651File DisclosureRoundcube Roundcube WebmailPatch this weekMetasploit module0.46
2CVE-2020-12641Remote Code ExecutionRoundcube Roundcube WebmailPatch this weekEPSS 0.840.84
3CVE-2021-44026SQL InjectionRoundcube Roundcube WebmailPatch this weekEPSS 0.700.70
4CVE-2020-35730Cross-Site Scripting (XSS)Roundcube Roundcube WebmailPatch soon0.33

Added each year

1232021: 1120212022: nonenone20222023: 3320232024: nonenone20242025: nonenone20252026: nonenone2026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20211
2022none
20233
2024none
2025none
2026none

Used in ransomware