Roundcube: exploited vulnerabilities
- 11exploited vulnerabilities
- 0used by ransomware
- Feb 20, 2026latest one added
- Webmail 7
- Roundcube Webmail 4
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.3 | 77% |
| Feb 12, 2024 | Persistent Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 64% |
| Oct 26, 2023 | Persistent Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 77% |
| Jun 22, 2023 | Webmail SQL Injection | Roundcube Webmail | Critical 9.8 | 70% |
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 33% |
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Webmail | Critical 9.8 | 84% |
| Nov 3, 2021 | Webmail File Disclosure | Roundcube Webmail | High 7.8 | 46% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.