CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 12:00 AM ET)

What this means for you

This week: 3,093 CVEs published, 234 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,093; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product roundcube:webmail. Show all products

67 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2017-16651 Known exploited	High 7.8	Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the… Assigned by mitre	Nov 9, 2017
CVE-2020-12641 Known exploited	Critical 9.8	rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. Assigned by mitre	May 4, 2020
CVE-2020-13965 Known exploited	Medium 6.3	An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. Assigned by mitre	Jun 8, 2020
CVE-2020-35730 Known exploited	Medium 6.1	An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. Assigned by mitre	Dec 28, 2020
CVE-2021-44026 Known exploited	Critical 9.8	Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Assigned by mitre	Nov 18, 2021
CVE-2023-43770 Known exploited	Medium 6.1	Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. Assigned by mitre	Sep 21, 2023
CVE-2023-5631 Known exploited	Medium 6.1	Stored XSS vulnerability in Roundcube Assigned by ESET	Oct 18, 2023
CVE-2024-37383 Known exploited	Medium 6.1	Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. Assigned by mitre	Jun 6, 2024
CVE-2024-42009 Known exploited	Critical 9.3	A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desani… Assigned by mitre	Aug 4, 2024
CVE-2025-49113 Known exploited	Critical 9.9	Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.ph… Assigned by mitre	Jun 1, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.