VENDOR

Roundcube vulnerabilities: CVEs, exploitation and patches

Every Roundcube CVE reviewed by Diras Labs analysts, newest first, with exploitation status and fixes.

CVE-2026-75003
Roundcube Webmail SVG url() bypass lets crafted images leak data Roundcube Webmail · Sep 29, 2026
- PATCH AVAILABLE
CRITICAL 9.8
CVE-2026-62643
Roundcube Webmail CSS sanitization SSRF and information disclosure Roundcube Webmail · Sep 29, 2026
- PATCH AVAILABLE
CRITICAL 10
CVE-2026-54433
Roundcube Webmail stored XSS zero-click via crafted email Roundcube Webmail · Sep 29, 2026
- PoC PUBLIC
- PATCH AVAILABLE
CRITICAL 10