Roundcube vulnerabilities in CISA KEV
Roundcube has 11 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 26th highest of any vendor. 2 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 21 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Webmail, with 7 entries. Other frequently affected products: Roundcube Webmail (4).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor roundcube --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
11
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-02-20
most recent entry
┌─ last 12 months
2
entries added
┌─ ransomware use
0 of 11
0% linked to ransomware
┌─ distinct products
2
affected products
$ awk -F, {print $1} /var/log/kev/roundcube.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 0 |
| 2023 | 4 | 0 |
| 2024 | 3 | 0 |
| 2025 | 1 | 0 |
| 2026 | 2 | 0 |
$ sort /var/log/kev/roundcube.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Webmail 7 entries
- Roundcube Webmail 4 entries
$ kev-due-dates --vendor roundcube
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Roundcube
21 days (range 21 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/roundcube.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (11 of 11 have at least one CWE).
$ grep -ril 'Roundcube' /var/log/news | head -5
Our reporting that names Roundcube or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./roundcube.kev · 11 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-49113
Webmail
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
due 2026-03-13 · CWE-502
$ cat CVE-2025-49113.txt
Description. RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-68461
Webmail
RoundCube Webmail Cross-site Scripting Vulnerability
due 2026-03-13 · CWE-79
$ cat CVE-2025-68461.txt
Description. RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-42009
Webmail
RoundCube Webmail Cross-Site Scripting Vulnerability
due 2025-06-30 · CWE-79
$ cat CVE-2024-42009.txt
Description. RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-37383
Webmail
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
due 2024-11-14 · CWE-79
$ cat CVE-2024-37383.txt
Description. RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-13965
Webmail
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
due 2024-07-17 · CWE-80
$ cat CVE-2020-13965.txt
Description. Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-43770
Webmail
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
due 2024-03-04 · CWE-79
$ cat CVE-2023-43770.txt
Description. Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-5631
Webmail
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
due 2023-11-16 · CWE-79
$ cat CVE-2023-5631.txt
Description. Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2020-12641
Roundcube Webmail
Roundcube Webmail Remote Code Execution Vulnerability
due 2023-07-13 · CWE-78
$ cat CVE-2020-12641.txt
Description. Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Required action. Apply updates per vendor instructions.
- CVE-2020-35730
Roundcube Webmail
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
due 2023-07-13 · CWE-79
$ cat CVE-2020-35730.txt
Description. Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Required action. Apply updates per vendor instructions.
- CVE-2021-44026
Roundcube Webmail
Roundcube Webmail SQL Injection Vulnerability
due 2023-07-13 · CWE-89
$ cat CVE-2021-44026.txt
Description. Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Required action. Apply updates per vendor instructions.
- CVE-2017-16651
Roundcube Webmail
Roundcube Webmail File Disclosure Vulnerability
due 2022-05-03 · CWE-552
$ cat CVE-2017-16651.txt
Description. Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Required action. Apply updates per vendor instructions.