Roundcube Webmail vulnerabilities
100 published vulnerabilities in Roundcube Webmail, 11 of them exploited in the wild. The most were published in 2026 (29), and 29 so far in 2026.
Roundcube Webmail vulnerabilities by year
2005
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2023
2024
2025
2026
Most exploited Roundcube Webmail vulnerabilities
- CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data
- CVE-2021-44026 Roundcube Webmail SQL Injection
- CVE-2020-12641 Roundcube Webmail Remote Code Execution
- CVE-2024-42009 RoundCube Webmail Cross-Site Scripting
- CVE-2017-16651 Roundcube Webmail File Disclosure
- CVE-2025-68461 RoundCube Webmail Cross-site Scripting
- CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS)
- CVE-2024-37383 RoundCube Webmail Cross-Site Scripting (XSS)
- CVE-2023-5631 Roundcube Webmail Persistent Cross-Site Scripting (XSS)
- CVE-2023-43770 Roundcube Webmail Persistent Cross-Site Scripting (XSS)
- CVE-2020-35730 Roundcube Webmail Cross-Site Scripting (XSS)
- CVE-2008-5619 PHPMailer susceptible to arbitrary code execution
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.