roundcube security advisories
2 threat alerts tracking vulnerabilities and security advisories that affect roundcube products.
Vulnios monitors roundcube CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent roundcube security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-37385 — roundcube, microsoft — webmail, windows
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12
criticalCVE-2024-37385Critical Vulnerability: CVE-2020-12640 — roundcube, opensuse — webmail, backports_sle
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
criticalCVE-2020-12640
Track roundcube exposure across your environment
Vulnios automatically cross-references your asset inventory against new roundcube CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan