# Roundcube Webmail vulnerabilities Source: https://junglewise.ai/threats/technologies/webmail Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 22:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/webmail.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 59 vulnerabilities in Roundcube Webmail: 1 in the last 7 days and 18 in the last 90 days, 11 of them critical and 11 exploited in the wild. The most recent, CVE-2026-126813, was published on 11 November 2026. 17 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 1 - Last 30 days: 18 - Last 90 days: 18 - All time: 59 (11 critical, 11 exploited in the wild) ## About Roundcube Webmail Web-based email client by Roundcube. ## Latest Roundcube Webmail vulnerabilities - [CVE-2026-126813: Roundcube Webmail IMAP command injection in message cache](https://junglewise.ai/threats/cve-2026-126813-roundcube-webmail-before-1-6-21-and-1-7-x-before-1-7-6-contains) (medium, CVSS 6.8, published 11 Nov 2026) - [CVE-2026-114732: Roundcube Webmail improper authentication in multi-host installations](https://junglewise.ai/threats/cve-2026-114732-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2026-114731: Roundcube Webmail uncontrolled resource consumption in CSS proxy](https://junglewise.ai/threats/cve-2026-114731-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-114730: Roundcube Webmail server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-114730-roundcube-webmail-1-6-14-before-1-6-20-and-1-7-0-before-1-7-5-is) (high, CVSS 7.2, published 22 Oct 2026) - [CVE-2026-114729: Roundcube Webmail content blocking bypass via SVG SMIL](https://junglewise.ai/threats/cve-2026-114729-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-114728: Roundcube Webmail remote content blocking bypass in CSS FuncIRI handling](https://junglewise.ai/threats/cve-2026-114728-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-114727: Roundcube Webmail unsafe content passed to ImageMagick](https://junglewise.ai/threats/cve-2026-114727-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-passes) (high, CVSS 8.3, published 22 Oct 2026) - [CVE-2026-114726: Roundcube Webmail mail header injection in Bounce action](https://junglewise.ai/threats/cve-2026-114726-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5.8, published 22 Oct 2026) - [CVE-2026-114725: Roundcube Webmail mail header injection](https://junglewise.ai/threats/cve-2026-114725-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5, published 22 Oct 2026) - [CVE-2026-114724: Roundcube Webmail object injection in session unserialization](https://junglewise.ai/threats/cve-2026-114724-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-contains) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114722: Roundcube Webmail CSS scoping bypass in HTML messages](https://junglewise.ai/threats/cve-2026-114722-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-114720: Roundcube Webmail IMAP command injection via CRLF in flag parameter](https://junglewise.ai/threats/cve-2026-114720-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (high, CVSS 7.1, published 22 Oct 2026) - [CVE-2026-114718: Roundcube Webmail cross-site scripting in password plugin](https://junglewise.ai/threats/cve-2026-114718-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 4.7, published 22 Oct 2026) - [CVE-2026-114717: Roundcube Webmail mail header injection via forwarded message subject](https://junglewise.ai/threats/cve-2026-114717-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 4, published 22 Oct 2026) - [CVE-2026-114716: Roundcube Webmail mail header injection in inline image data URI](https://junglewise.ai/threats/cve-2026-114716-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (high, CVSS 8.5, published 22 Oct 2026) - [CVE-2026-114715: Roundcube Webmail incorrect authorization in Modoboa password driver](https://junglewise.ai/threats/cve-2026-114715-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2026-114714: Roundcube Webmail path traversal in squirrelmail_usercopy plugin](https://junglewise.ai/threats/cve-2026-114714-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-113386: Roundcube Webmail IMAP command injection in mail actions](https://junglewise.ai/threats/cve-2026-113386-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-are) (high, CVSS 7.1, published 20 Oct 2026) - [CVE-2026-54433: Roundcube Webmail stored XSS in plain-text rendering](https://junglewise.ai/threats/cve-2026-54433-roundcube-webmail-stored-xss-in-plain-text-rendering) (high, CVSS 7.2, published 14 Jul 2026) - [CVE-2026-54432: Roundcube Webmail stored XSS in attachment-validation warning page](https://junglewise.ai/threats/cve-2026-54432-roundcube-webmail-stored-xss-in-attachment-validation-warning) (medium, CVSS 4.7, published 14 Jul 2026) - [CVE-2026-62644: Roundcube Webmail username spoofing in password plugin](https://junglewise.ai/threats/cve-2026-62644-roundcube-webmail-username-spoofing-in-password-plugin) (medium, CVSS 6.4, published 14 Jul 2026) - [CVE-2026-62643: Roundcube Webmail SSRF via insufficient CSS sanitization](https://junglewise.ai/threats/cve-2026-62643-roundcube-webmail-ssrf-via-insufficient-css-sanitization) (high, CVSS 7.2, published 14 Jul 2026) - [CVE-2026-62642: Roundcube Webmail infinite loop in TNEF decoder](https://junglewise.ai/threats/cve-2026-62642-roundcube-webmail-infinite-loop-in-tnef-decoder) (medium, CVSS 4.3, published 14 Jul 2026) - [CVE-2026-62641: Roundcube Webmail denial of service in TNEF decoder](https://junglewise.ai/threats/cve-2026-62641-roundcube-webmail-denial-of-service-in-tnef-decoder) (medium, CVSS 4.3, published 14 Jul 2026) - [CVE-2026-9818: Roundcube Webmail SSRF bypass in HTML sanitization](https://junglewise.ai/threats/cve-2026-9818-roundcube-webmail-ssrf-bypass-in-html-sanitization) (medium, CVSS 4.7, published 28 May 2026) ## Most severe Roundcube Webmail vulnerabilities - [CVE-2021-44026: Roundcube Webmail SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2021-44026-roundcube-webmail-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 22 Jun 2023) - [CVE-2020-12641: Roundcube Webmail Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-12641-roundcube-webmail-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 22 Jun 2023) - [CVE-2024-42009: Roundcube Webmail XSS in message_body function](https://junglewise.ai/threats/cve-2024-42009-roundcube-webmail-xss-in-message-body-function) (critical, exploited in the wild, CVSS 9.3, published 9 Jun 2025) - [CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability](https://junglewise.ai/threats/cve-2017-16651-roundcube-webmail-file-disclosure-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 3 Nov 2021) - [CVE-2025-68461: Roundcube Webmail XSS in SVG animate tag](https://junglewise.ai/threats/cve-2025-68461-roundcube-webmail-xss-in-svg-animate-tag) (critical, exploited in the wild, CVSS 7.2, published 20 Feb 2026) - [CVE-2024-37383: RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2024-37383-roundcube-webmail-cross-site-scripting-xss-vulnerability) (critical, exploited in the wild, CVSS 6.1, published 24 Oct 2024) - [CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2020-13965-roundcube-webmail-cross-site-scripting-xss-vulnerability) (critical, exploited in the wild, CVSS 6.1, published 26 Jun 2024) - [CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-43770-roundcube-webmail-persistent-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 12 Feb 2024) - [CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2020-35730-roundcube-webmail-cross-site-scripting-xss-vulnerability) (critical, exploited in the wild, CVSS 6.1, published 22 Jun 2023) - [CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-5631-roundcube-webmail-persistent-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 5.4, published 26 Oct 2023) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 17 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Roundcube Webmail vulnerabilities", https://junglewise.ai/threats/technologies/webmail, 11 November 2026.