roundcube
Safeguard articles tagged "roundcube" — guides, analysis, and best practices for software supply chain and application security.
12 articles
CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
CVE-2017-16651 affects Roundcube Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2021-11-03.
CVE-2021-44026: Roundcube Webmail SQL Injection Vulnerability
CVE-2021-44026 affects Roundcube Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2023-06-22.
CVE-2020-12641: Roundcube Webmail Remote Code Execution Vulnerability
CVE-2020-12641 affects Roundcube Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2023-06-22.
CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
CVE-2020-35730 affects Roundcube Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2023-06-22.
CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
CVE-2023-5631 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2023-10-26.
CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
CVE-2023-43770 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2024-02-12.
CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
CVE-2020-13965 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2024-06-26.
CVE-2024-37383: RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
CVE-2024-37383 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2024-10-24.
CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability
CVE-2024-42009 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2025-06-09.
CVE-2025-68461: RoundCube Webmail Cross-site Scripting Vulnerability
CVE-2025-68461 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-02-20.
CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability
CVE-2025-49113 affects Roundcube Webmail and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-02-20.
Roundcube's Same-Day KEV Entries: A 9.9 Deserialization Bug and an SVG XSS Foothold
A near-maximum-severity PHP deserialization RCE and a stored XSS bug via SVG animate tags landed in CISA's KEV catalogue on the same date, describing a realistic foothold-to-RCE chain.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.