Roundcube Webmail

6 known vulnerabilities in Roundcube Webmail, 5 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2025-68461 CVSS 6.1 medium · actively exploited RoundCube Webmail Cross-site Scripting Vulnerability
  • CVE-2025-49113 CVSS 8.8 high · actively exploited RoundCube Webmail Deserialization of Untrusted Data Vulnerability
  • CVE-2024-37383 CVSS 6.1 medium · actively exploited RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
  • CVE-2023-43770 CVSS 6.1 medium · actively exploited Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
  • CVE-2020-13965 CVSS 6.1 medium · actively exploited Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Latest vulnerabilities

  • CVE-2026-48842 CVSS 8.1 high Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a…
  • CVE-2025-68461 CVSS 6.1 medium · actively exploited RoundCube Webmail Cross-site Scripting Vulnerability
  • CVE-2025-49113 CVSS 8.8 high · actively exploited RoundCube Webmail Deserialization of Untrusted Data Vulnerability
  • CVE-2024-37383 CVSS 6.1 medium · actively exploited RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
  • CVE-2023-43770 CVSS 6.1 medium · actively exploited Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
  • CVE-2020-13965 CVSS 6.1 medium · actively exploited Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability