Roundcube Webmail vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202655

Known exploitedNewest addition to KEV first

• CVE-2025-68461

  Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

  Roundcube · Webmail

  ExploitedHigh7.2
• CVE-2025-49113

  Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not…

  Roundcube · Webmail

  ExploitedCritical9.9

Newest CVEs

• CVE-2026-114732

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in…

  Roundcube · Webmail

  Medium6.8
• CVE-2026-114731

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss…

  Roundcube · Webmail

  Medium5.3
• CVE-2026-114730

  Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by…

  Roundcube · Webmail

  High7.2
• CVE-2026-114729

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation…

  Roundcube · Webmail

  Medium5.3
• CVE-2026-114728

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml…

  Roundcube · Webmail

  Medium5.3
• CVE-2026-114727

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as…

  Roundcube · Webmail

  High8.3
• CVE-2026-114726

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action.…

  Roundcube · Webmail

  Medium5.8
• CVE-2026-114725

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only…

  Roundcube · Webmail

  Medium5.0
• CVE-2026-114724

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!”…

  Roundcube · Webmail

  High7.4
• CVE-2026-114723

  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image…

  Roundcube · Webmail

  Low3.7