EN
DeutschEnglishEspañolFrançaisItaliano

Start free Dashboard

Exploited vulnerabilities

Roundcube

11 Roundcube vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.

In the catalogue11
Last 12 months2
In ransomware campaigns0
Last addition20 February 2026

The vulnerabilities11

  1. 20 February 2026CVE-2025-68461WebmailRoundCube Webmail Cross-site Scripting Vulnerability
  2. 20 February 2026CVE-2025-49113WebmailRoundCube Webmail Deserialization of Untrusted Data Vulnerability
  3. 9 June 2025CVE-2024-42009WebmailRoundCube Webmail Cross-Site Scripting Vulnerability
  4. 24 October 2024CVE-2024-37383WebmailRoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
  5. 26 June 2024CVE-2020-13965WebmailRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
  6. 12 February 2024CVE-2023-43770WebmailRoundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
  7. 26 October 2023CVE-2023-5631WebmailRoundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
  8. 22 June 2023CVE-2021-44026Roundcube WebmailRoundcube Webmail SQL Injection Vulnerability
  9. 22 June 2023CVE-2020-35730Roundcube WebmailRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
  10. 22 June 2023CVE-2020-12641Roundcube WebmailRoundcube Webmail Remote Code Execution Vulnerability
  11. 3 November 2021CVE-2017-16651Roundcube WebmailRoundcube Webmail File Disclosure Vulnerability

Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.

Alerts only on the products you use

With My Defence you receive alerts and briefings only on the products you use, Roundcube included.

Start freeMy Defence

All vendorsThe catalogue on the CISA website