{"schema_version":1,"title":"Roundcube vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 37 vulnerabilities in Roundcube: 0 in the last 7 days and 6 in the last 90 days, 11 of them critical and 11 exploited in the wild. The most recent, CVE-2026-54433, was published on 14 July 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/roundcube","json_url":"https://junglewise.ai/threats/vendors/roundcube.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/roundcube","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":8,"all_time":37,"critical":11,"exploited":11,"last_7_days":0,"last_30_days":0,"last_90_days":6,"last_365_days":25},"latest":[{"cve":"CVE-2026-54433","cvss":7.2,"slug":"cve-2026-54433-roundcube-webmail-stored-xss-in-plain-text-rendering","title":"Roundcube Webmail stored XSS in plain-text rendering","severity":"high","exploited":false,"published_at":"2026-07-14T17:17:05.53+00:00","url":"https://junglewise.ai/threats/cve-2026-54433-roundcube-webmail-stored-xss-in-plain-text-rendering"},{"cve":"CVE-2026-54432","cvss":4.7,"slug":"cve-2026-54432-roundcube-webmail-stored-xss-in-attachment-validation-warning","title":"Roundcube Webmail stored XSS in attachment-validation warning page","severity":"medium","exploited":false,"published_at":"2026-07-14T17:17:05.387+00:00","url":"https://junglewise.ai/threats/cve-2026-54432-roundcube-webmail-stored-xss-in-attachment-validation-warning"},{"cve":"CVE-2026-62644","cvss":6.4,"slug":"cve-2026-62644-roundcube-webmail-username-spoofing-in-password-plugin","title":"Roundcube Webmail username spoofing in password plugin","severity":"medium","exploited":false,"published_at":"2026-07-14T16:17:04.81+00:00","url":"https://junglewise.ai/threats/cve-2026-62644-roundcube-webmail-username-spoofing-in-password-plugin"},{"cve":"CVE-2026-62643","cvss":7.2,"slug":"cve-2026-62643-roundcube-webmail-ssrf-via-insufficient-css-sanitization","title":"Roundcube Webmail SSRF via insufficient CSS sanitization","severity":"high","exploited":false,"published_at":"2026-07-14T16:17:04.67+00:00","url":"https://junglewise.ai/threats/cve-2026-62643-roundcube-webmail-ssrf-via-insufficient-css-sanitization"},{"cve":"CVE-2026-62642","cvss":4.3,"slug":"cve-2026-62642-roundcube-webmail-infinite-loop-in-tnef-decoder","title":"Roundcube Webmail infinite loop in TNEF decoder","severity":"medium","exploited":false,"published_at":"2026-07-14T16:17:04.53+00:00","url":"https://junglewise.ai/threats/cve-2026-62642-roundcube-webmail-infinite-loop-in-tnef-decoder"},{"cve":"CVE-2026-62641","cvss":4.3,"slug":"cve-2026-62641-roundcube-webmail-denial-of-service-in-tnef-decoder","title":"Roundcube Webmail denial of service in TNEF decoder","severity":"medium","exploited":false,"published_at":"2026-07-14T16:17:04.377+00:00","url":"https://junglewise.ai/threats/cve-2026-62641-roundcube-webmail-denial-of-service-in-tnef-decoder"},{"cve":"CVE-2026-9818","cvss":4.7,"slug":"cve-2026-9818-roundcube-webmail-ssrf-bypass-in-html-sanitization","title":"Roundcube Webmail SSRF bypass in HTML sanitization","severity":"medium","exploited":false,"published_at":"2026-05-28T13:16:25.44+00:00","url":"https://junglewise.ai/threats/cve-2026-9818-roundcube-webmail-ssrf-bypass-in-html-sanitization"},{"cve":"CVE-2026-48849","cvss":4.4,"epss":0.0003,"slug":"cve-2026-48849-roundcube-webmail-stored-xss-in-draft-restore-dialog-subject","title":"Roundcube Webmail stored XSS in draft restore dialog subject field","severity":"medium","exploited":false,"published_at":"2026-05-25T20:16:37.54+00:00","url":"https://junglewise.ai/threats/cve-2026-48849-roundcube-webmail-stored-xss-in-draft-restore-dialog-subject"},{"cve":"CVE-2026-48848","cvss":7.2,"epss":0.0004,"slug":"cve-2026-48848-roundcube-webmail-css-injection-in-html-sanitizer-via-svg-animate","title":"Roundcube Webmail CSS injection in HTML sanitizer via SVG animate","severity":"high","exploited":false,"published_at":"2026-05-25T20:16:37.413+00:00","url":"https://junglewise.ai/threats/cve-2026-48848-roundcube-webmail-css-injection-in-html-sanitizer-via-svg-animate"},{"cve":"CVE-2026-48847","cvss":3.7,"epss":0.0006,"slug":"cve-2026-48847-roundcube-webmail-arbitrary-file-deletion-via-session-poisoning","title":"Roundcube Webmail arbitrary file deletion via session poisoning","severity":"low","exploited":false,"published_at":"2026-05-25T20:16:37.287+00:00","url":"https://junglewise.ai/threats/cve-2026-48847-roundcube-webmail-arbitrary-file-deletion-via-session-poisoning"},{"cve":"CVE-2026-48846","cvss":6.5,"epss":0.0003,"slug":"cve-2026-48846-roundcube-webmail-remote-image-blocking-bypass-via-css-var","title":"Roundcube Webmail remote image blocking bypass via CSS var()","severity":"medium","exploited":false,"published_at":"2026-05-25T20:16:37.16+00:00","url":"https://junglewise.ai/threats/cve-2026-48846-roundcube-webmail-remote-image-blocking-bypass-via-css-var"},{"cve":"CVE-2026-48845","cvss":6.5,"epss":0.0003,"slug":"cve-2026-48845-roundcube-webmail-remote-image-blocking-bypass-in-html-sanitizer","title":"Roundcube Webmail remote image blocking bypass in HTML sanitizer","severity":"medium","exploited":false,"published_at":"2026-05-25T20:16:37.027+00:00","url":"https://junglewise.ai/threats/cve-2026-48845-roundcube-webmail-remote-image-blocking-bypass-in-html-sanitizer"},{"cve":"CVE-2026-48844","cvss":7.5,"epss":0.0005,"slug":"cve-2026-48844-roundcube-webmail-code-injection-in-ldap-autovalues-option","title":"Roundcube Webmail code injection in LDAP autovalues option","severity":"high","exploited":false,"published_at":"2026-05-25T20:16:36.893+00:00","url":"https://junglewise.ai/threats/cve-2026-48844-roundcube-webmail-code-injection-in-ldap-autovalues-option"},{"cve":"CVE-2026-48843","cvss":7.2,"epss":0.0003,"slug":"cve-2026-48843-roundcube-webmail-ssrf-via-insufficient-css-sanitization","title":"Roundcube Webmail SSRF via insufficient CSS sanitization","severity":"high","exploited":false,"published_at":"2026-05-25T20:16:36.767+00:00","url":"https://junglewise.ai/threats/cve-2026-48843-roundcube-webmail-ssrf-via-insufficient-css-sanitization"},{"cve":"CVE-2026-48842","cvss":8.1,"epss":0.0008,"slug":"cve-2026-48842-roundcube-webmail-sql-injection-in-virtuser-query-plugin","title":"Roundcube Webmail SQL injection in virtuser_query plugin","severity":"high","exploited":false,"published_at":"2026-05-25T20:16:36.63+00:00","url":"https://junglewise.ai/threats/cve-2026-48842-roundcube-webmail-sql-injection-in-virtuser-query-plugin"},{"cve":"CVE-2026-35545","cvss":5.3,"epss":0.0055,"slug":"cve-2026-35545-roundcube-webmail-remote-image-blocking-bypass-in-svg-content","title":"Roundcube Webmail remote image blocking bypass in SVG content","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.98+00:00","url":"https://junglewise.ai/threats/cve-2026-35545-roundcube-webmail-remote-image-blocking-bypass-in-svg-content"},{"cve":"CVE-2026-35544","cvss":5.3,"epss":0.0051,"slug":"cve-2026-35544-roundcube-webmail-css-sanitization-bypass-in-html-email","title":"Roundcube Webmail CSS sanitization bypass in HTML email","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.81+00:00","url":"https://junglewise.ai/threats/cve-2026-35544-roundcube-webmail-css-sanitization-bypass-in-html-email"},{"cve":"CVE-2026-35543","cvss":5.3,"epss":0.0053,"slug":"cve-2026-35543-roundcube-webmail-remote-image-blocking-bypass-in-svg-content","title":"Roundcube Webmail remote image blocking bypass in SVG content","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.637+00:00","url":"https://junglewise.ai/threats/cve-2026-35543-roundcube-webmail-remote-image-blocking-bypass-in-svg-content"},{"cve":"CVE-2026-35542","cvss":5.3,"epss":0.0053,"slug":"cve-2026-35542-roundcube-webmail-remote-image-blocking-bypass-in-body-element","title":"Roundcube Webmail remote image blocking bypass in BODY element","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.46+00:00","url":"https://junglewise.ai/threats/cve-2026-35542-roundcube-webmail-remote-image-blocking-bypass-in-body-element"},{"cve":"CVE-2026-35541","cvss":4.2,"epss":0.0031,"slug":"cve-2026-35541-roundcube-webmail-type-confusion-in-password-plugin","title":"Roundcube Webmail type confusion in password plugin","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.283+00:00","url":"https://junglewise.ai/threats/cve-2026-35541-roundcube-webmail-type-confusion-in-password-plugin"},{"cve":"CVE-2026-35540","cvss":5.4,"epss":0.0043,"slug":"cve-2026-35540-roundcube-webmail-ssrf-via-insufficient-css-sanitization","title":"Roundcube Webmail SSRF via insufficient CSS sanitization","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:22.1+00:00","url":"https://junglewise.ai/threats/cve-2026-35540-roundcube-webmail-ssrf-via-insufficient-css-sanitization"},{"cve":"CVE-2026-35539","cvss":6.1,"epss":0.0035,"slug":"cve-2026-35539-roundcube-webmail-xss-in-html-attachment-preview","title":"Roundcube Webmail XSS in HTML attachment preview","severity":"medium","exploited":false,"published_at":"2026-04-03T05:16:21.92+00:00","url":"https://junglewise.ai/threats/cve-2026-35539-roundcube-webmail-xss-in-html-attachment-preview"},{"cve":"CVE-2026-35538","cvss":3.1,"epss":0.0036,"slug":"cve-2026-35538-roundcube-webmail-imap-injection-in-mail-search","title":"Roundcube Webmail IMAP injection in mail search","severity":"low","exploited":false,"published_at":"2026-04-03T05:16:21.647+00:00","url":"https://junglewise.ai/threats/cve-2026-35538-roundcube-webmail-imap-injection-in-mail-search"},{"cve":"CVE-2026-35537","cvss":3.7,"epss":0.006,"slug":"cve-2026-35537-roundcube-webmail-unsafe-deserialization-in-session-handler","title":"Roundcube Webmail unsafe deserialization in session handler","severity":"low","exploited":false,"published_at":"2026-04-03T04:17:10.313+00:00","url":"https://junglewise.ai/threats/cve-2026-35537-roundcube-webmail-unsafe-deserialization-in-session-handler"},{"cve":"CVE-2025-68461","cvss":7.2,"epss":0.0852,"slug":"cve-2025-68461-roundcube-webmail-xss-in-svg-animate-tag","title":"Roundcube Webmail XSS in SVG animate tag","severity":"critical","exploited":true,"published_at":"2026-02-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-68461-roundcube-webmail-xss-in-svg-animate-tag"}],"vendor":{"hub":true,"name":"Roundcube","slug":"roundcube","homepage":"https://roundcube.net/","description":"An open-source project providing a browser-based IMAP client.","url":"https://junglewise.ai/threats/vendors/roundcube"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2020-12641","cvss":9.8,"slug":"cve-2020-12641-roundcube-webmail-remote-code-execution-vulnerability","title":"Roundcube Webmail Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2023-06-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-12641-roundcube-webmail-remote-code-execution-vulnerability"},{"cve":"CVE-2021-44026","cvss":9.8,"slug":"cve-2021-44026-roundcube-webmail-sql-injection-vulnerability","title":"Roundcube Webmail SQL Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2023-06-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-44026-roundcube-webmail-sql-injection-vulnerability"},{"cve":"CVE-2024-42009","cvss":9.3,"epss":0.9141,"slug":"cve-2024-42009-roundcube-webmail-xss-in-message-body-function","title":"Roundcube Webmail XSS in message_body function","severity":"critical","exploited":true,"published_at":"2025-06-09T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-42009-roundcube-webmail-xss-in-message-body-function"},{"cve":"CVE-2017-16651","cvss":7.8,"slug":"cve-2017-16651-roundcube-webmail-file-disclosure-vulnerability","title":"Roundcube Webmail File Disclosure Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2017-16651-roundcube-webmail-file-disclosure-vulnerability"},{"cve":"CVE-2025-68461","cvss":7.2,"epss":0.0852,"slug":"cve-2025-68461-roundcube-webmail-xss-in-svg-animate-tag","title":"Roundcube Webmail XSS in SVG animate tag","severity":"critical","exploited":true,"published_at":"2026-02-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-68461-roundcube-webmail-xss-in-svg-animate-tag"},{"cve":"CVE-2024-37383","cvss":6.1,"slug":"cve-2024-37383-roundcube-webmail-cross-site-scripting-xss-vulnerability","title":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","severity":"critical","exploited":true,"published_at":"2024-10-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-37383-roundcube-webmail-cross-site-scripting-xss-vulnerability"},{"cve":"CVE-2020-13965","cvss":6.1,"slug":"cve-2020-13965-roundcube-webmail-cross-site-scripting-xss-vulnerability","title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","severity":"critical","exploited":true,"published_at":"2024-06-26T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-13965-roundcube-webmail-cross-site-scripting-xss-vulnerability"},{"cve":"CVE-2023-43770","cvss":6.1,"slug":"cve-2023-43770-roundcube-webmail-persistent-cross-site-scripting-xss","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","severity":"critical","exploited":true,"published_at":"2024-02-12T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-43770-roundcube-webmail-persistent-cross-site-scripting-xss"},{"cve":"CVE-2020-35730","cvss":6.1,"slug":"cve-2020-35730-roundcube-webmail-cross-site-scripting-xss-vulnerability","title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","severity":"critical","exploited":true,"published_at":"2023-06-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-35730-roundcube-webmail-cross-site-scripting-xss-vulnerability"},{"cve":"CVE-2023-5631","cvss":5.4,"slug":"cve-2023-5631-roundcube-webmail-persistent-cross-site-scripting-xss","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","severity":"critical","exploited":true,"published_at":"2023-10-26T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5631-roundcube-webmail-persistent-cross-site-scripting-xss"}],"generated_at":"2026-09-26T20:07:00.238639+00:00","technologies":[{"name":"Roundcube Webmail","slug":"webmail","vulnerabilities":41,"url":"https://junglewise.ai/threats/technologies/webmail"}]}