Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.4In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection o…May 25, 2026
- High7.2Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG docu…May 25, 2026
- Low3.7Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.May 25, 2026
- Medium6.5In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message,…May 25, 2026
- Medium6.5In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, whi…May 25, 2026
- High7.5Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection.May 25, 2026
- High7.2Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to…May 25, 2026
- High8.1Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.May 25, 2026
- High8.2An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15.Apr 3, 2026
- Medium5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Medium5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Medium5.3An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Medium4.2An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Medium6.5An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14.Apr 3, 2026
- Medium6.1An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Low3.1An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- High7.5An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14.Apr 3, 2026
- Medium6.1RoundCube Webmail Cross-site Scripting VulnerabilityKEVEPSS 26.8%Dec 17, 2025
- High8.8RoundCube Webmail Deserialization of Untrusted Data VulnerabilityKEVEPSS 99.0%Jun 1, 2025
- UnknownMultiples vulnérabilités dans Roundcube (09 août 2024)EPSS 34.2%Aug 9, 2024
- Critical9.3RoundCube Webmail Cross-Site Scripting VulnerabilityKEVEPSS 82.9%Aug 5, 2024
- Medium6.1RoundCube Webmail Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 73.3%Jun 6, 2024
- Medium5.4Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 75.9%Oct 18, 2023
- Medium6.1Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 63.7%Sep 21, 2023
- Critical9.8Roundcube Webmail SQL Injection VulnerabilityKEVEPSS 69.9%Nov 18, 2021
29 records · page 1 of 2
PreviousNext