Is Roundcube webmail safe right now?
Nothing new in 90 days
No Roundcube webmail flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 20, 2026). Keep automatic updates on: that can change any day.
0exploited in the last 30 days
0in the last 90 days
0zero-days in 2026
11on CISA's list, all time
Earlier exploited flaws
- RoundCube Webmail Cross-site Scripting Vulnerability
- RoundCube Webmail Deserialization of Untrusted Data Vulnerability
- RoundCube Webmail Cross-Site Scripting Vulnerability
- RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
- Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Roundcube Webmail SQL Injection Vulnerability
- Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- Roundcube Webmail Remote Code Execution Vulnerability
- Roundcube Webmail File Disclosure Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 2 | 0 |
| 2025 | 1 | 0 |
| 2024 | 3 | 0 |
| 2023 | 4 | 0 |
| 2022 | 0 | 0 |
Questions
Is Roundcube webmail safe right now?
No Roundcube webmail flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 20, 2026). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Roundcube webmail vulnerabilities have been exploited?
11 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks.
Covers products matching roundcube. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.