{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Roundcube vulnerabilities","home_page_url":"https://patchfirst.co/vendor/roundcube/","feed_url":"https://patchfirst.co/feed/vendor/roundcube.json","description":"New and newly exploited Roundcube CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-48842","url":"https://patchfirst.co/cve/CVE-2026-48842/","title":"CVE-2026-48842: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the…","content_text":"Roundcube · Webmail. Not in CISA KEV. EPSS 1.7% (higher than 77.2% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 73.6 of 100.","summary":"Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the…","date_published":"2026-05-25T00:00:00.000Z","date_modified":"2026-09-25T03:55:21.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73.6,"kev":null,"epss":{"score":0.01699,"percentile":0.77174},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-49113#kev","url":"https://patchfirst.co/cve/CVE-2025-49113/","title":"[KEV] CVE-2025-49113: RoundCube Webmail Deserialization of Untrusted Data Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2026-02-20. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.","summary":"RoundCube Webmail Deserialization of Untrusted Data Vulnerability","date_published":"2026-02-20T00:00:00.000Z","date_modified":"2026-06-17T09:30:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.1,"kev":{"dateAdded":"2026-02-20","ransomware":false},"epss":{"score":0.99491,"percentile":0.99945},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-68461#kev","url":"https://patchfirst.co/cve/CVE-2025-68461/","title":"[KEV] CVE-2025-68461: RoundCube Webmail Cross-site Scripting Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2026-02-20. ENISA EUVD lists it as exploited. EPSS 27.4% (higher than 98.1% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript. Priority 71.9 of 100.","summary":"RoundCube Webmail Cross-site Scripting Vulnerability","date_published":"2026-02-20T00:00:00.000Z","date_modified":"2026-06-17T09:59:06.000Z","tags":["kev","public-exploit","T1204.001","T1059.007"],"_patchfirst":{"reason":"kev","priority":71.9,"kev":{"dateAdded":"2026-02-20","ransomware":false},"epss":{"score":0.27407,"percentile":0.98064},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1204.001","T1059.007"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-42009#kev","url":"https://patchfirst.co/cve/CVE-2024-42009/","title":"[KEV] CVE-2024-42009: RoundCube Webmail Cross-Site Scripting Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2025-06-09. ENISA EUVD lists it as exploited. EPSS 82.9% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1114 Email Collection. Priority 69.4 of 100.","summary":"RoundCube Webmail Cross-Site Scripting Vulnerability","date_published":"2025-06-09T00:00:00.000Z","date_modified":"2026-06-17T07:48:37.000Z","tags":["kev","public-exploit","T1566.002","T1056","T1114"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-06-09","ransomware":false},"epss":{"score":0.82882,"percentile":0.99671},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1566.002","T1056","T1114"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-37383#kev","url":"https://patchfirst.co/cve/CVE-2024-37383/","title":"[KEV] CVE-2024-37383: RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2024-10-24. ENISA EUVD lists it as exploited. EPSS 74.0% (higher than 99.48% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript. Priority 67.2 of 100.","summary":"RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability","date_published":"2024-10-24T00:00:00.000Z","date_modified":"2026-06-17T07:38:15.000Z","tags":["kev","public-exploit","T1204.001","T1059.007"],"_patchfirst":{"reason":"kev","priority":67.2,"kev":{"dateAdded":"2024-10-24","ransomware":false},"epss":{"score":0.73995,"percentile":0.9948},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1204.001","T1059.007"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-13965#kev","url":"https://patchfirst.co/cve/CVE-2020-13965/","title":"[KEV] CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2024-06-26. ENISA EUVD lists it as exploited. EPSS 76.6% (higher than 99.54% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 67.2 of 100.","summary":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","date_published":"2024-06-26T00:00:00.000Z","date_modified":"2026-06-17T02:54:01.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":67.2,"kev":{"dateAdded":"2024-06-26","ransomware":false},"epss":{"score":0.76596,"percentile":0.99542},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-43770#kev","url":"https://patchfirst.co/cve/CVE-2023-43770/","title":"[KEV] CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2024-02-12. ENISA EUVD lists it as exploited. EPSS 63.7% (higher than 99.22% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter; T1082 System Information Discovery. Priority 67.1 of 100.","summary":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","date_published":"2024-02-12T00:00:00.000Z","date_modified":"2026-06-17T06:26:24.000Z","tags":["kev","public-exploit","T1189","T1059","T1082"],"_patchfirst":{"reason":"kev","priority":67.1,"kev":{"dateAdded":"2024-02-12","ransomware":false},"epss":{"score":0.6366,"percentile":0.99215},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1189","T1059","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-5631#kev","url":"https://patchfirst.co/cve/CVE-2023-5631/","title":"[KEV] CVE-2023-5631: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Webmail. In CISA KEV since 2023-10-26. ENISA EUVD lists it as exploited. EPSS 76.3% (higher than 99.54% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1041 Exfiltration Over C2 Channel. Priority 66.7 of 100.","summary":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","date_published":"2023-10-26T00:00:00.000Z","date_modified":"2026-06-17T06:48:58.000Z","tags":["kev","public-exploit","T1204.001","T1059.007","T1041"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2023-10-26","ransomware":false},"epss":{"score":0.76337,"percentile":0.99538},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Webmail","techniqueIds":["T1204.001","T1059.007","T1041"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-12641#kev","url":"https://patchfirst.co/cve/CVE-2020-12641/","title":"[KEV] CVE-2020-12641: Roundcube Webmail Remote Code Execution Vulnerability","content_text":"Roundcube · Roundcube Webmail. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 84.4% (higher than 99.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Roundcube Webmail Remote Code Execution Vulnerability","date_published":"2023-06-22T00:00:00.000Z","date_modified":"2026-06-17T02:52:03.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-06-22","ransomware":false},"epss":{"score":0.84387,"percentile":0.99699},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Roundcube Webmail","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44026#kev","url":"https://patchfirst.co/cve/CVE-2021-44026/","title":"[KEV] CVE-2021-44026: Roundcube Webmail SQL Injection Vulnerability","content_text":"Roundcube · Roundcube Webmail. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 69.9% (higher than 99.37% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.7 of 100.","summary":"Roundcube Webmail SQL Injection Vulnerability","date_published":"2023-06-22T00:00:00.000Z","date_modified":"2026-06-17T04:11:48.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2023-06-22","ransomware":false},"epss":{"score":0.69882,"percentile":0.99371},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Roundcube","product":"Roundcube Webmail","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-35730#kev","url":"https://patchfirst.co/cve/CVE-2020-35730/","title":"[KEV] CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","content_text":"Roundcube · Roundcube Webmail. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 32.9% (higher than 98.4% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter. Priority 66.9 of 100.","summary":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","date_published":"2023-06-22T00:00:00.000Z","date_modified":"2026-06-17T03:14:12.000Z","tags":["kev","public-exploit","T1189","T1059"],"_patchfirst":{"reason":"kev","priority":66.9,"kev":{"dateAdded":"2023-06-22","ransomware":false},"epss":{"score":0.3292,"percentile":0.98354},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Roundcube","product":"Roundcube Webmail","techniqueIds":["T1189","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-16651#kev","url":"https://patchfirst.co/cve/CVE-2017-16651/","title":"[KEV] CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability","content_text":"Roundcube · Roundcube Webmail. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 45.7% (higher than 98.8% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1005 Data from Local System. Priority 68.2 of 100.","summary":"Roundcube Webmail File Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:09:37.000Z","tags":["kev","public-exploit","T1078","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.45742,"percentile":0.98798},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Roundcube","product":"Roundcube Webmail","techniqueIds":["T1078","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}