Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

roundcube/roundcubemail

The Roundcube Webmail suite

Composer latest 1.7.4 GPL-3.0-or-later

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

1.7.4

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

10 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

10
GHSA-8j8w-wwqc-x596 critical CISA KEV

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Affected range

ECOSYSTEM: introduced 0; fixed 1.5.10ECOSYSTEM: introduced 1.6.0; fixed 1.6.11>=1.6.0,<1.6.11|<1.5.10

Fixed versions: 1.5.10, 1.6.11

CVE-2025-49113 Source ↗Source ↗
GHSA-j2g6-8rvg-7mf6 moderate

Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message

Affected range

ECOSYSTEM: introduced 1.7-beta; fixed 1.7-rc5>=1.7-beta,<1.7-rc5

Fixed versions: 1.7-rc5

CVE-2026-35543 Source ↗Source ↗
GHSA-w846-74jr-76cv moderate

Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message

Affected range

ECOSYSTEM: introduced 1.7-beta; fixed 1.7-rc5>=1.7-beta,<1.7-rc5

Fixed versions: 1.7-rc5

CVE-2026-35545 Source ↗Source ↗