Known vulnerabilities in Roundcube Webmail

Vendor: Roundcube
Software CPE: cpe:2.3:a:roundcube:roundcube:*:*:*:*:*:*:*:*
Total vulnerabilities: 64
Public exploits: 9
Known exploited (KEV): 11
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Roundcube Webmail Roundcube Webmail is affected by 64 known vulnerabilities: 3 critical, 8 high, 36 medium, 17 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136900 - Allocation of Resources Without Limits or Throttling
CWE-770 Medium
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
#VU136901 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835 Medium
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
#VU136902 - Improper Access Control
CWE-284 Low
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
#VU136903 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54432
CWE-79 Medium
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
SB2026070717
SB2026070718
and 2 more
#VU136904 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
#VU136905 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54433
CWE-79 Medium
No
No
1.6.17, 1.7.2 05.07.2026 SB2026070504
SB2026070717
SB2026070718
and 2 more
#VU132212 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132213 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132214 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Critical
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132215 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132216 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132217 - Improper input validation
CWE-20 Low
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132218 - External Control of File Name or Path
CWE-73 Medium
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU132219 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
1.6.16, 1.7.1 25.05.2026 SB2026052501
#VU124665 - Protection Mechanism Failure
CWE-693 Medium
No
No
1.5.15, 1.6.15 30.03.2026 SB2026033005
#VU124136 - Deserialization of Untrusted Data
CWE-502 Critical
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124137 - Missing Authentication for Critical Function
CWE-306 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124138 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-93 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124139 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124141 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948


Showing elements 1 - 20 out of 64