Fixed in
CVEs affecting 1.7
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-114716 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | 8.5 | — | 2026-10-22 | |
| CVE-2026-114727 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when... | 8.3 | — | 2026-10-22 | |
| CVE-2026-114724 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session... | 7.4 | — | 2026-10-22 | |
| CVE-2026-114730 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery fil... | 7.2 | — | 2026-10-22 | |
| CVE-2026-114720 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.... | 7.1 | — | 2026-10-22 | |
| CVE-2026-113386 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authen... | 7.1 | — | 2026-10-20 | |
| CVE-2026-114715 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability... | 6.8 | — | 2026-10-22 | |
| CVE-2026-114732 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability... | 6.8 | — | 2026-10-22 | |
| CVE-2026-114722 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. r... | 6.5 | — | 2026-10-22 | |
| CVE-2026-114726 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in... | 5.8 | — | 2026-10-22 | |
| CVE-2026-114714 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the sq... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114731 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vul... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114728 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114729 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_... | 5.3 | — | 2026-10-22 | |
| CVE-2026-114725 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | 5.0 | — | 2026-10-22 | |
| CVE-2026-114718 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in... | 4.7 | — | 2026-10-22 | |
| CVE-2026-114717 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability wh... | 4.0 | — | 2026-10-22 | |
| CVE-2026-114719 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-... | 3.7 | — | 2026-10-22 | |
| CVE-2026-114723 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed d... | 3.7 | — | 2026-10-22 | |
| CVE-2026-114721 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be... | 3.1 | — | 2026-10-22 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).