Class familyRoundcube · Webmail
Roundcube Webmail cross-site scripting flaws, 2020–2026
15 Webmail CVEs with CWE-79 weaknesses, 9 Jun 2020 to 22 Oct 2026. 7 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
2 2020’20
2021’21
2022’22
2 2023’23
2 2024’24
1 2025’25
8 2026’26
In CISA KEVNot in KEV
20202 CVEs, 2 in KEV
20232 CVEs, 2 in KEV
20242 CVEs, 2 in KEV
20251 CVE, 1 in KEV
20268 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2020-13965KEV | 9 Jun 2020 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 67.2 |
| CVE-2020-35730KEV | 28 Dec 2020 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 66.9 |
| CVE-2023-43770KEV | 22 Sep 2023 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 67.1 |
| CVE-2023-5631KEV | 18 Oct 2023 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 66.7 |
| CVE-2024-37383KEV | 7 Jun 2024 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 67.2 |
| CVE-2024-42009KEV | 5 Aug 2024 | RoundCube Webmail Cross-Site Scripting Vulnerability | Grouped by weakness | 69.4 |
| CVE-2025-68461KEV | 18 Dec 2025 | RoundCube Webmail Cross-site Scripting Vulnerability | Grouped by weakness | 71.9 |
| CVE-2026-35539 | 3 Apr 2026 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 | Grouped by weakness | 7.6 |
| CVE-2026-48848 | 25 May 2026 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to… | Grouped by weakness | 11.6 |
| CVE-2026-48849 | 25 May 2026 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored… | Grouped by weakness | 11.1 |
| CVE-2026-54432 | 14 Jul 2026 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) | Grouped by weakness | 5.4 |
| CVE-2026-54433 | 14 Jul 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted… | Grouped by weakness | 14.8 |
| CVE-2026-74998 | 17 Aug 2026 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were… | Grouped by weakness | 12.7 |
| CVE-2026-74999 | 17 Aug 2026 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS | Grouped by weakness | 9.8 |
| CVE-2026-114718 | 22 Oct 2026 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the… | Grouped by weakness | 6.3 |