Roundcube: CISA KEV History
Every Roundcube vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.
Snapshot: 2026-09-08 · Source: CISA KEV Catalog · Full KEV dashboard
KEV entries
11
Added, last 12 months
2
Ransomware-linked
0
Latest addition
2026-02-20
Roundcube KEV additions per month, last 24 months
Most-listed products: Webmail, Roundcube Webmail.
Latest 11 of 11 Roundcube KEV entries
| CVE | Vulnerability | Added | Ransomware |
|---|---|---|---|
| CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability | 2026-02-20 | No |
| CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability | 2026-02-20 | No |
| CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting Vulnerability | 2025-06-09 | No |
| CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-10-24 | No |
| CVE-2020-13965 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-06-26 | No |
| CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 2024-02-12 | No |
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 2023-10-26 | No |
| CVE-2020-35730 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 2023-06-22 | No |
| CVE-2020-12641 | Roundcube Webmail Remote Code Execution Vulnerability | 2023-06-22 | No |
| CVE-2021-44026 | Roundcube Webmail SQL Injection Vulnerability | 2023-06-22 | No |
| CVE-2017-16651 | Roundcube Webmail File Disclosure Vulnerability | 2021-11-03 | No |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.