Ramas de versiones afectadas
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2025-68461 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability v... | * | 7.2 | KEV | 27.4% | 2025-12-18 |
| CVE-2025-49113 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users be... | * | 9.9 | KEV | 99.6% | 2025-06-02 |
| CVE-2024-42009 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attack... | * | 9.3 | KEV | 82.9% | 2024-08-05 |
| CVE-2024-37383 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | * | 6.1 | KEV | 74.0% | 2024-06-07 |
| CVE-2023-5631 | Stored XSS vulnerability in Roundcube | ≥ 1.6.0 < 1.6.3 ≥ 1.5.0 < 1.5.4 ≥ 1.4.0 < 1.5.14 | 6.1 | KEV | 76.3% | 2023-10-18 |
| CVE-2023-43770 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages... | * | 6.1 | KEV | 63.7% | 2023-09-22 |
| CVE-2021-44026 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_par... | * | 9.8 | KEV | 69.9% | 2021-11-19 |
| CVE-2020-35730 | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.... | * | 6.1 | KEV | 32.9% | 2020-12-29 |
| CVE-2020-13965 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a maliciou... | * | 6.3 | KEV | 76.6% | 2020-06-09 |
| CVE-2020-12641 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacha... | * | 9.8 | KEV | 84.4% | 2020-05-04 |
| CVE-2017-16651 | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbi... | * | 7.8 | KEV | 45.7% | 2017-11-09 |
| CVE-2026-126813 | Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid | * | 7.4 | — | 2026-11-12 | |
| CVE-2026-114732 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 6.8 | — | 2026-10-22 | |
| CVE-2026-114731 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vul... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.3 | — | 2026-10-22 | |
| CVE-2026-114730 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery fil... | ≥ 1.6.14 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 7.2 | — | 2026-10-22 | |
| CVE-2026-114729 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.3 | — | 2026-10-22 | |
| CVE-2026-114728 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.3 | — | 2026-10-22 | |
| CVE-2026-114727 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 8.3 | — | 2026-10-22 | |
| CVE-2026-114726 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.8 | — | 2026-10-22 | |
| CVE-2026-114725 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.0 | — | 2026-10-22 | |
| CVE-2026-114724 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 7.4 | — | 2026-10-22 | |
| CVE-2026-114723 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed d... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 3.7 | — | 2026-10-22 | |
| CVE-2026-114722 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. r... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 6.5 | — | 2026-10-22 | |
| CVE-2026-114721 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 3.1 | — | 2026-10-22 | |
| CVE-2026-114720 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 7.1 | — | 2026-10-22 | |
| CVE-2026-114719 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 3.7 | — | 2026-10-22 | |
| CVE-2026-114718 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 4.7 | — | 2026-10-22 | |
| CVE-2026-114717 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability wh... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 4.0 | — | 2026-10-22 | |
| CVE-2026-114716 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. r... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 8.5 | — | 2026-10-22 | |
| CVE-2026-114715 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 6.8 | — | 2026-10-22 | |
| CVE-2026-114714 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the sq... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 5.3 | — | 2026-10-22 | |
| CVE-2026-113386 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authen... | ≥ 1.6.0 < 1.6.20 ≥ 1.7.0 < 1.7.5 | 7.1 | — | 2026-10-20 | |
| CVE-2026-75010 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could lea... | * | 6.4 | — | 2026-08-17 | |
| CVE-2026-75007 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via... | * | 5.4 | — | 2026-08-17 | |
| CVE-2026-75006 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitizat... | * | 5.8 | — | 2026-08-17 | |
| CVE-2026-75004 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesiev... | * | 4.3 | — | 2026-08-17 | |
| CVE-2026-75003 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG... | * | 5.8 | — | 2026-08-17 | |
| CVE-2026-75002 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronizati... | * | 7.1 | — | 2026-08-17 | |
| CVE-2026-75000 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "... | * | 5.8 | — | 2026-08-17 | |
| CVE-2026-74999 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to sto... | * | 5.4 | — | 2026-08-17 | |
| CVE-2026-74998 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) pro... | * | 7.2 | — | 2026-08-17 | |
| CVE-2026-74997 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is su... | * | 8.8 | — | 2026-08-17 | |
| CVE-2026-62644 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was su... | * | 6.4 | — | 2026-07-15 | |
| CVE-2026-62643 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitizat... | * | 7.2 | — | 2026-07-15 | |
| CVE-2026-62642 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder... | * | 4.3 | — | 2026-07-15 | |
| CVE-2026-62641 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service v... | * | 4.3 | — | 2026-07-15 | |
| CVE-2026-48849 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft res... | * | 4.4 | — | 2026-05-26 | |
| CVE-2026-48848 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead... | * | 7.2 | — | 2026-05-26 | |
| CVE-2026-48847 | Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletio... | * | 3.7 | — | 2026-05-26 | |
| CVE-2026-48846 | In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypa... | * | 6.5 | — | 2026-05-26 | |
| CVE-2026-48845 | In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not hon... | * | 6.5 | — | 2026-05-26 | |
| CVE-2026-48844 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the au... | * | 7.5 | — | 2026-05-26 | |
| CVE-2026-48843 | Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Shee... | * | 7.2 | — | 2026-05-26 | |
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtu... | * | 8.1 | — | 2026-05-26 | |
| CVE-2026-35545 | An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can b... | * | 5.3 | — | 2026-04-03 | |
| CVE-2026-35544 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CS... | * | 5.3 | — | 2026-04-03 | |
| CVE-2026-35543 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can b... | * | 5.3 | — | 2026-04-03 | |
| CVE-2026-35542 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can b... | * | 5.3 | — | 2026-04-03 | |
| CVE-2026-35541 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the pa... | * | 4.2 | — | 2026-04-03 | |
| CVE-2026-35540 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sa... | * | 5.4 | — | 2026-04-03 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).