CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 9:50 PM ET)

What this means for you

This week: 3,090 CVEs published, 232 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,090; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product roundcube:webmail. Show all products

67 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-114732	Medium 6.8	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. Assigned by mitre	Oct 21, 2026
CVE-2026-114731	Medium 5.3	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). Assigned by mitre	Oct 21, 2026
CVE-2026-114730	High 7.2	Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. Assigned by mitre	Oct 21, 2026
CVE-2026-114729	Medium 5.3	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. Assigned by mitre	Oct 21, 2026
CVE-2026-114728	Medium 5.3	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. Assigned by mitre	Oct 21, 2026
CVE-2026-114727	High 8.3	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. Assigned by mitre	Oct 21, 2026
CVE-2026-114726	Medium 5.8	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. Assigned by mitre	Oct 21, 2026
CVE-2026-114725	Medium 5.0	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. Assigned by mitre	Oct 21, 2026
CVE-2026-114724	High 7.4	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). Assigned by mitre	Oct 21, 2026
CVE-2026-114723	Low 3.7	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. Assigned by mitre	Oct 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.