# Roundcube vulnerabilities > Roundcube has 78 published vulnerabilities across 3 products in our catalogue. 9 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Webmail, with 75. If you run Roundcube software, patch the exploited flaws first. Canonical page: https://www.precursorintelligence.com/vendors/roundcube ## At a glance - **Published vulnerabilities:** 78 - **Known to be exploited:** 9 - **Products:** 3 - **Versions:** 263 - **Most recently added to the known-exploited list:** [CVE-2024-42009](https://www.precursorintelligence.com/what-is/cve-2024-42009), 9 June 2025. We keep watching the list. ## Which Roundcube products have the most vulnerabilities? - [Webmail](https://www.precursorintelligence.com/product/roundcube/webmail): 75 published vulnerabilities, 140 versions - [Roundcube Webmail](https://www.precursorintelligence.com/product/roundcube/roundcube_webmail): 7 published vulnerabilities, 12 versions - [Roundcube](https://www.precursorintelligence.com/product/roundcube/roundcube): 1 published vulnerability, 111 versions Each product page lists its own known-exploited flaws. ## Which Roundcube vulnerabilities are being exploited? 9 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2024-42009](https://www.precursorintelligence.com/what-is/cve-2024-42009): RoundCube Webmail Cross-Site Scripting Vulnerability. Critical, CVSS 9.3, chance of use in 30 days 83%, known exploited since 9 June 2025. - [CVE-2024-37383](https://www.precursorintelligence.com/what-is/cve-2024-37383): RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 73%, known exploited since 24 October 2024. - [CVE-2020-13965](https://www.precursorintelligence.com/what-is/cve-2020-13965): Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 77%, known exploited since 26 June 2024. - [CVE-2023-43770](https://www.precursorintelligence.com/what-is/cve-2023-43770): Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 64%, known exploited since 12 February 2024. - [CVE-2023-5631](https://www.precursorintelligence.com/what-is/cve-2023-5631): Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 76%, known exploited since 26 October 2023. - [CVE-2021-44026](https://www.precursorintelligence.com/what-is/cve-2021-44026): Roundcube Webmail SQL Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 70%, known exploited since 22 June 2023. - [CVE-2020-12641](https://www.precursorintelligence.com/what-is/cve-2020-12641): Roundcube Webmail Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 84%, known exploited since 22 June 2023. - [CVE-2020-35730](https://www.precursorintelligence.com/what-is/cve-2020-35730): Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 33%, known exploited since 22 June 2023. - [CVE-2017-16651](https://www.precursorintelligence.com/what-is/cve-2017-16651): Roundcube Webmail File Disclosure Vulnerability. High, CVSS 7.8, chance of use in 30 days 46%, known exploited since 3 November 2021. ## Which Roundcube flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2020-12641](https://www.precursorintelligence.com/what-is/cve-2020-12641): 84%, Critical (CVSS 9.8), known exploited - [CVE-2024-42009](https://www.precursorintelligence.com/what-is/cve-2024-42009): 83%, Critical (CVSS 9.3), known exploited - [CVE-2020-13965](https://www.precursorintelligence.com/what-is/cve-2020-13965): 77%, Medium (CVSS 6.1), known exploited - [CVE-2023-5631](https://www.precursorintelligence.com/what-is/cve-2023-5631): 76%, Medium (CVSS 6.1), known exploited - [CVE-2024-37383](https://www.precursorintelligence.com/what-is/cve-2024-37383): 73%, Medium (CVSS 6.1), known exploited - [CVE-2021-44026](https://www.precursorintelligence.com/what-is/cve-2021-44026): 70%, Critical (CVSS 9.8), known exploited - [CVE-2023-43770](https://www.precursorintelligence.com/what-is/cve-2023-43770): 64%, Medium (CVSS 6.1), known exploited - [CVE-2008-5619](https://www.precursorintelligence.com/what-is/cve-2008-5619): 59%, Critical (CVSS 10.0) - [CVE-2018-19206](https://www.precursorintelligence.com/what-is/cve-2018-19206): 56%, Medium (CVSS 6.1) - [CVE-2017-16651](https://www.precursorintelligence.com/what-is/cve-2017-16651): 46%, High (CVSS 7.8), known exploited ## All Roundcube products we track 3 products with at least one tracked version, most vulnerabilities first: - [Webmail](https://www.precursorintelligence.com/product/roundcube/webmail): 75 vulnerabilities, 140 versions - [Roundcube Webmail](https://www.precursorintelligence.com/product/roundcube/roundcube_webmail): 7 vulnerabilities, 12 versions - [Roundcube](https://www.precursorintelligence.com/product/roundcube/roundcube): 1 vulnerability, 111 versions ## Questions ### How many vulnerabilities does Roundcube have? Our catalogue lists 78 published vulnerabilities across 3 products and 263 versions from Roundcube. The most recent Roundcube flaw added to the known-exploited list is CVE-2024-42009, on 9 June 2025. ### Which Roundcube vulnerabilities are being exploited? 9 Roundcube vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2024-42009, CVE-2024-37383 and CVE-2020-13965. The full list is on this page. ### Which Roundcube product has the most vulnerabilities? Webmail, with 75 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new Roundcube vulnerabilities? Create a Precursor Intelligence account and track the Roundcube products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running Roundcube? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact