Roundcube Webmail

Search everything

Mentions · 7d0
Mentions · 30d2
All mentions9
First seenSep 21, 2026
Last mentioned20d ago

Timeline

9 articles · newest first

Roundcube Webmail before 1.6.20 and 1.7.5 has security flaws

Canadian advisory AV26-1075 names the fixed releases but gives no CVE identifiers or impact details.

Canadian Centre for Cyber SecurityOct 22, 12:36 UTC · 20d agoAdvisory1

Roundcube webmail fixes injection, XSS and SSRF flaws

Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.

oss-securityOct 20, 16:42 UTC · 22d agoVulnerability1

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild

Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.

Security AffairsSep 28, 05:50 UTC · Sep 28, 2026Exploit / PoCExploitedCVE-2026-48842 CVE-2025-49113 CVE-2025-684614

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.

The Hacker NewsSep 25, 10:14 UTC · Sep 25, 2026Exploit / PoCExploitedCVE-2026-48842 CVE-2025-49113 CVE-2025-684612 · 2 reads

Roundcube SQLi (CVE-2026-48842) Exploited

Pre-authentication Roundcube Webmail SQL injection CVE-2026-48842 is reportedly exploited months after patches.

SOCRadarSep 25, 09:41 UTC · Sep 25, 2026Exploit / PoCExploitedCVE-2026-488422

Hackers now exploit critical Roundcube flaw in code injection attacks

Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.

BleepingComputerSep 24, 13:27 UTC · Sep 24, 2026Exploit / PoCExploitedCVE-2026-48842 CVE-2023-5631 CVE-2020-35730+48 · 2 reads

Roundcube Webmail Flaw Lets Attackers Trigger SQL Injection Without Authentication

Unauthenticated SQL injection CVE-2026-48842 in Roundcube Webmail is being actively exploited on unpatched servers.

GBHackersSep 24, 09:56 UTC · Sep 24, 2026Exploit / PoCExploitedCVE-2026-488426 · 1 read

Roundcube Webmail SQL Injection Vulnerability Exploited in the Wild

Attackers are exploiting pre-authentication SQL injection CVE-2026-48842 in Roundcube Webmail before 1.6.16 and 1.7.1.

Cyber Security NewsSep 24, 07:37 UTC · Sep 24, 2026Exploit / PoCExploitedCVE-2026-488423

Roundcube security advisory (AV26-503) – Update 1

Canada's Cyber Centre says CVE-2026-48842 in Roundcube Webmail is exploited and urges patching.

Canadian Centre for Cyber SecuritySep 21, 20:20 UTC · Sep 21, 2026Exploit / PoCExploitedCVE-2026-488422 · 1 read

Related CVEs

by mentions

CVE-2026-488422%8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
published May 25, 2026PoC ×3
CVE-2025-49113100%8.8
Authenticated PHP Object Deserialization RCE in Roundcube Webmail
published Jun 2, 2025Roundcube WebmailKEVPoC ×2
CVE-2025-6846127%6.1
Cross-Site Scripting via SVG animate Tag in Roundcube Webmail
published Dec 18, 2025Roundcube WebmailKEV
CVE-2021-4402670%9.8
SQL Injection in Roundcube Webmail via Search Parameters
published Nov 19, 2021Roundcube WebmailKEV
CVE-2020-1264184%9.8
Command Injection RCE in Roundcube Webmail (CVE-2020-12641)
published May 4, 2020roundcube webmailKEVPoC
CVE-2020-3573033%6.1
Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling
published Dec 28, 2020Roundcube WebmailKEV
CVE-2023-563176%5.4
Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631)
published Oct 18, 2023Roundcube WebmailKEVPoC

Appears with

Roundcubevendor · 9
Canadian Centre for Cyber Securityorganization · 7
CISAorganization · 3
UNK_MassTractionthreat actor · 2
VShellmalware · 2
SentinelOneorganization · 2
APT28threat actor · 1
Proofpointorganization · 1
SOCRadarorganization · 1
Shadowserver Foundationorganization · 1
Shadowserverorganization · 1
Winter Vivernthreat actor · 1
cPanelproduct · 1

Entities are extracted by the model from each article. First seen Sep 21, 2026, last mentioned 20d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.