Known vulnerabilities in Roundcube Webmail 1.4.10

Vendor: Roundcube
Version: 1.4.10
Software CPE: cpe:2.3:a:roundcube:roundcube:*:*:*:*:*:*:*:*
Total vulnerabilities: 26
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Roundcube Webmail version 1.4.10 Roundcube Webmail 1.4.10 is affected by 26 vulnerabilities: 1 critical, 3 high, 17 medium, 5 low Critical High Medium Low

Vulnerabilities (26)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141369 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141370 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141371 - Improper input validation
CWE-20 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141372 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-90 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141373 - Improper Access Control
CWE-284 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141374 - Command injection
CWE-77 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141375 - Improper input validation
CWE-20 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141376 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141377 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141378 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141368 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU124136 - Deserialization of Untrusted Data
CWE-502 Critical
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124137 - Missing Authentication for Critical Function
CWE-306 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124138 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-93 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124139 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124140 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124141 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124142 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124143 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU82545 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-43770
CWE-79 High
Public exploit available
Exploited
1.4.14, 1.5.4, 1.6.3 28.10.2023 SB2023102803
SB2023103004
SB2024022613


Showing elements 1 - 20 out of 26