Search for packages
| purl | pkg:deb/debian/roundcube@1.4.15%2Bdfsg.1-1%2Bdeb11u4 |
| Next non-vulnerable version | 1.6.5+dfsg-1+deb12u6 |
| Latest non-vulnerable version | 1.6.5+dfsg-1+deb12u6 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2hap-9mqs-v3b8
Aliases: CVE-2026-35541 GHSA-46pv-mj2g-93gh |
Roundcube Webmail: Incorrect password comparison in the password plugin |
Affected by 0 other vulnerabilities. |
|
VCID-2nb2-9vgp-tqg9
Aliases: CVE-2025-68460 |
roundcubemail: Roundcube Webmail: Information Disclosure via HTML Style Sanitizer |
Affected by 0 other vulnerabilities. |
|
VCID-3kyu-tx4q-p3aq
Aliases: CVE-2025-49113 GHSA-8j8w-wwqc-x596 |
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. |
Affected by 0 other vulnerabilities. |
|
VCID-4yzj-hrqv-vbcp
Aliases: CVE-2026-25916 |
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. |
Affected by 0 other vulnerabilities. |
|
VCID-5yts-xnha-4bf3
Aliases: CVE-2026-35539 GHSA-x4q5-8j5g-hpjc |
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode |
Affected by 0 other vulnerabilities. |
|
VCID-8vmm-1hvf-17ap
Aliases: CVE-2026-35542 GHSA-5hf6-crg4-fg59 |
Roundcube: Bypass of remote image blocking via crafted BODY background attribute |
Affected by 0 other vulnerabilities. |
|
VCID-8xf2-hjfv-hybh
Aliases: CVE-2026-35544 GHSA-xpqh-grpw-4xmg |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
Affected by 0 other vulnerabilities. |
|
VCID-9uv1-gqq7-3kc9
Aliases: CVE-2025-68461 |
roundcubemail: Roundcube Webmail: Cross-Site Scripting (XSS) vulnerability via crafted SVG animate tag |
Affected by 0 other vulnerabilities. |
|
VCID-ck88-1urs-2kes
Aliases: CVE-2026-35543 GHSA-j2g6-8rvg-7mf6 |
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message |
Affected by 0 other vulnerabilities. |
|
VCID-ddfq-28qm-2fbn
Aliases: CVE-2026-35545 GHSA-w846-74jr-76cv |
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message |
Affected by 0 other vulnerabilities. |
|
VCID-gh6k-19h8-fqbf
Aliases: CVE-2026-35538 GHSA-8jr8-v43g-5c57 |
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments |
Affected by 0 other vulnerabilities. |
|
VCID-rdb5-bbvn-7fcq
Aliases: CVE-2019-15237 |
Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
Affected by 0 other vulnerabilities. |
|
VCID-ub6x-9dku-c7fk
Aliases: CVE-2026-35540 GHSA-vxg2-hhgr-37fx |
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
Affected by 0 other vulnerabilities. |
|
VCID-vtz8-zmp4-xbdh
Aliases: CVE-2026-26079 |
roundcubemail: Roundcube Webmail: Cascading Style Sheets (CSS) injection via mishandled comments |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-14vp-t71a-4bh1 | security update |
CVE-2021-46144
|
| VCID-2eyy-k49d-m3af | Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
CVE-2021-44026
|
| VCID-2k4q-26tk-j3gx | security update |
CVE-2024-42010
|
| VCID-36et-26h7-pke7 | security update |
CVE-2024-42008
|
| VCID-79me-pjdn-ykgq | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12640
|
| VCID-7nn6-aywu-z7g8 | security update |
CVE-2020-13964
|
| VCID-9der-5csu-nbbq | security update |
CVE-2024-42009
|
| VCID-cjkd-2jr6-n7as | roundcubemail: allows XSS via SVG animate attributes |
CVE-2024-37383
|
| VCID-cnkc-vcp7-6kcw | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12626
|
| VCID-hg1a-vx5c-hue3 | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12641
|
| VCID-jck5-xymf-s3bh | security update |
CVE-2020-16145
|
| VCID-jqs5-8ct7-wfgk | Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. |
CVE-2021-26925
|
| VCID-kyxz-v3sj-w3cw | Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php. |
CVE-2020-18671
|
| VCID-m4yc-ms54-zyhv | security update |
CVE-2020-13965
|
| VCID-ncbg-6m11-3qan | security update |
CVE-2023-47272
|
| VCID-qwak-6wgy-wfgs | security update |
CVE-2024-37384
|
| VCID-rc91-j3kf-zfch | security update |
CVE-2020-15562
|
| VCID-s6p1-rf35-euhy | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. |
CVE-2023-43770
|
| VCID-u8a4-4pe2-9kcb | security update |
CVE-2020-35730
|
| VCID-vehj-ytsm-kqgz | security update |
CVE-2023-5631
|
| VCID-x9j7-98zt-6ygt | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12625
|
| VCID-xssa-fwbx-kybq | Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php. |
CVE-2020-18670
|
| VCID-ybv7-hqmj-nbgr | Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
CVE-2021-44025
|