Roundcube Webmail

Name: Roundcube Webmail
Brand: Roundcube

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

4critical5high5medium0low

updated 2026-10-26

vulnerabilities (38)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-49113US	high8.8OT critical	99.7% (100th)	KEV	1.5.10	2025-06-02	4 versions
CVE-2025-68461US	medium6.1OT critical	27.4% (98th)	KEV	1.5.12	2025-12-18	3 versions
CVE-2026-48842US	—	1.70% (77th)	Exploit	1.6.16	2026-05-25	2 versions
CVE-2026-25916US	—	0.76% (55th)	Exploit	1.5.13	2026-02-09	2 versions
CVE-2026-54433US	critical10.0	0.31% (24th)	Exploit	1.6.17	2026-07-14	2 versions
CVE-2026-48849US	—	0.24% (15th)	Exploit	1.7.1	2026-05-25	2 versions
CVE-2026-75002US	—	2.28% (83rd)	—	1.7.3	2026-08-17	2 versions
CVE-2026-74997US	—	1.13% (66th)	—	1.6.18	2026-08-17	2 versions
CVE-2026-75003US	critical9.8	0.58% (47th)	—	1.6.18	2026-08-17	2 versions
CVE-2026-62642US	medium6.5	0.52% (44th)	—	1.6.17	2026-07-14	2 versions
CVE-2026-62644US	critical9.8	0.50% (43rd)	—	1.6.17	2026-07-14	2 versions
CVE-2026-75007US	high8.8	0.50% (43rd)	—	1.7.3	2026-08-17	2 versions
CVE-2026-35537US	high7.5	0.47% (41st)	—	1.6.14	2026-04-03	2 versions
CVE-2026-75000US	—	0.47% (40th)	—	1.7.3	2026-08-17	2 versions
CVE-2026-62641US	medium6.5	0.47% (40th)	—	1.6.17	2026-07-14	2 versions
CVE-2026-74998US	—	0.44% (38th)	—	1.7.3	2026-08-17	2 versions
CVE-2026-48847US	—	0.43% (37th)	—	1.7.1	2026-05-25	2 versions
CVE-2026-75006US	—	0.42% (36th)	—	1.6.18	2026-08-17	2 versions
CVE-2026-48844US	—	0.41% (35th)	—	1.6.16	2026-05-25	2 versions
CVE-2026-35538US	—	0.41% (35th)	—	1.6.14	2026-04-03	2 versions
CVE-2026-48846US	—	0.40% (35th)	—	1.7.1	2026-05-25	2 versions
CVE-2026-35543US	—	0.40% (34th)	—	1.5.14	2026-04-03	2 versions
CVE-2026-35542US	—	0.40% (34th)	—	1.5.14	2026-04-03	2 versions
CVE-2026-35545US	high8.2	0.39% (33rd)	—	1.6.15	2026-04-03	2 versions
CVE-2026-75010US	medium4.3	0.39% (33rd)	—	1.7.3	2026-08-17	2 versions
CVE-2026-48848US	—	0.39% (33rd)	—	1.7.1	2026-05-25	2 versions
CVE-2026-35540US	medium6.5	0.39% (32nd)	—	1.6.14	2026-04-03	1.6.0 → 1.6.14
CVE-2026-48845US	—	0.38% (31st)	—	1.7.1	2026-05-25	2 versions
CVE-2026-75004US	—	0.37% (31st)	—	1.6.18	2026-08-17	2 versions
CVE-2026-35544US	—	0.37% (30th)	—	1.5.14	2026-04-03	2 versions
CVE-2026-74999US	—	0.36% (30th)	—	1.7.3	2026-08-17	2 versions
CVE-2026-26079US	—	0.35% (28th)	—	1.5.13	2026-02-11	2 versions
CVE-2025-68460US	high7.5	0.28% (21st)	—	1.6.12	2025-12-18	2 versions
CVE-2026-48843US	—	0.27% (19th)	—	1.7.1	2026-05-25	2 versions
CVE-2026-35539US	—	0.25% (16th)	—	1.5.14	2026-04-03	2 versions
CVE-2026-62643US	critical10.0	0.25% (16th)	—	1.6.17	2026-07-14	2 versions
CVE-2026-35541US	—	0.24% (15th)	—	1.6.14	2026-04-03	2 versions
CVE-2026-54432US	—	0.21% (11th)	—	1.6.17	2026-07-14	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-669Incorrect Resource Transfer Between Spheres11 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8 CVEs
CWE-918Server-Side Request Forgery (SSRF)4 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')3 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-116Improper Encoding or Escaping of Output1 CVEs
CWE-290Authentication Bypass by Spoofing1 CVEs
CWE-420Unprotected Alternate Channel1 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)38 CVEs
NLNCSC-NL (CSAF)2 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan