Vendors / Roundcube

Roundcube vulnerabilities being exploited

2 Roundcube flaws were confirmed exploited in the wild in the past 365 days, across 1 product: Webmail. If you run any of them, patch these first.

Added	Exploited vulnerability	Fix by
2026-02-20	CVE-2025-68461 Webmail RoundCube Webmail Cross-site Scripting Vulnerability RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.	2026-03-13
2026-02-20	CVE-2025-49113 Webmail RoundCube Webmail Deserialization of Untrusted Data Vulnerability RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.	2026-03-13

Watch my Roundcube software Scan a website All vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.30 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.