Security Digest
Roundcube: known exploited vulnerabilities
7 Roundcube CVEs CISA has confirmed as exploited in the wild since October 2023. If you run these products, check each one.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2026-02-20 | CVE-2025-68461 | Roundcube Webmail RoundCube Webmail Cross-site Scripting Vulnerability | 2026-03-13 |
| 2026-02-20 | CVE-2025-49113 | Roundcube Webmail RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 2026-03-13 |
| 2025-06-09 | CVE-2024-42009 | Roundcube Webmail RoundCube Webmail Cross-Site Scripting Vulnerability | 2025-06-30 |
| 2024-10-24 | CVE-2024-37383 | Roundcube Webmail RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-11-14 |
| 2024-06-26 | CVE-2020-13965 | Roundcube Webmail Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-07-17 |
| 2024-02-12 | CVE-2023-43770 | Roundcube Webmail Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 2024-03-04 |
| 2023-10-26 | CVE-2023-5631 | Roundcube Webmail Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 2023-11-16 |