Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Webmail — Vulnerabilities & Security Advisories 45

All 45 CVE vulnerabilities found in Webmail, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerability data for the Webmail product category, focusing on weaknesses identified within client-side and server-side email web interfaces. The collection encompasses a broad spectrum of reported flaws, including cross-site scripting, authentication bypasses, and remote code execution, covering incidents disclosed from the early 2000s through the current year. Readers can utilize this resource to track vendor-specific security advisories, analyze the prevalence of specific weakness classes across different implementations, or review the complete historical vulnerability timeline for any given webmail solution. By consolidating fragmented reports into a single view, this aggregation facilitates a clearer understanding of the evolving threat landscape targeting web-based email systems. Security professionals and system administrators will find this data essential for conducting risk assessments, prioritizing patch management efforts, and developing defensive strategies against recurring attack vectors. The information presented here serves as a foundational reference for identifying patterns in how attackers exploit webmail architectures over time. No specific CVE identifiers are listed in this summary, but the underlying dataset allows for detailed queries regarding individual incidents. This continuous update cycle ensures that the repository remains current with the latest disclosed threats, providing a reliable source for ongoing security research and operational defense planning within the email sector.

Vendor: Roundcube

CVE ID Title CVSS Severity Published
CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint CWE-918 7.5 High 2026-10-20
CVE-2026-113386 Roundcube 1.6.20/1.7.5 之前版本存在 IMAP 命令注入漏洞 CWE-93 7.1 High 2026-10-20
CVE-2026-75010 Roundcube Webmail 权限许可和访问控制问题漏洞 CWE-669 6.4 Medium 2026-08-17
CVE-2026-75007 Roundcube Webmail 命令注入漏洞 CWE-77 5.4 Medium 2026-08-17
CVE-2026-75006 Roundcube Webmail 服务端请求伪造漏洞 CWE-918 5.8 Medium 2026-08-17
CVE-2026-75004 Roundcube Webmail 命令注入漏洞 CWE-77 4.3 Medium 2026-08-17
CVE-2026-75003 Roundcube Webmail 权限许可和访问控制问题漏洞 CWE-669 5.8 Medium 2026-08-17
CVE-2026-75002 Roundcube Webmail 命令注入漏洞 CWE-77 7.1 High 2026-08-17
CVE-2026-75000 Roundcube Webmail 权限许可和访问控制问题漏洞 CWE-669 5.8 Medium 2026-08-17
CVE-2026-74999 Roundcube Webmail 跨站脚本漏洞 CWE-79 5.4 Medium 2026-08-17
CVE-2026-74998 Roundcube Webmail 跨站脚本漏洞 CWE-79 7.2 High 2026-08-17
CVE-2026-74997 Roundcube Webmail 命令注入漏洞 CWE-78 8.8 High 2026-08-17
CVE-2026-54432 Roundcube webmail 跨站脚本漏洞 CWE-79 4.7 Medium 2026-07-14
CVE-2026-54433 Roundcube webmail 跨站脚本漏洞 CWE-79 7.2 High 2026-07-14
CVE-2026-62644 Roundcube webmail 授权问题漏洞 CWE-290 6.4 Medium 2026-07-14
CVE-2026-62643 Roundcube webmail 服务端请求伪造漏洞 CWE-918 7.2 High 2026-07-14
CVE-2026-62642 Roundcube webmail 资源管理错误漏洞 CWE-835 4.3 Medium 2026-07-14
CVE-2026-62641 Roundcube webmail 资源管理错误漏洞 CWE-770 4.3 Medium 2026-07-14
CVE-2026-48849 Roundcube Webmail 跨站脚本漏洞 CWE-79 4.4 Medium 2026-05-25
CVE-2026-48848 Roundcube Webmail 跨站脚本漏洞 CWE-79 7.2 High 2026-05-25
CVE-2026-48847 Roundcube Webmail 安全漏洞 CWE-669 3.7 Low 2026-05-25
CVE-2026-48846 Roundcube Webmail 安全漏洞 CWE-669 6.5 Medium 2026-05-25
CVE-2026-48845 Roundcube Webmail 安全漏洞 CWE-669 6.5 Medium 2026-05-25
CVE-2026-48844 Roundcube Webmail 安全漏洞 CWE-670 7.5 High 2026-05-25
CVE-2026-48843 Roundcube Webmail 代码问题漏洞 CWE-918 7.2 High 2026-05-25
CVE-2026-48842 Roundcube Webmail SQL注入漏洞 CWE-89 8.1 High 2026-05-25
CVE-2026-35391 Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery CWE-348 9.1AI Critical AI 2026-04-06
CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks CWE-79 5.4AI Medium AI 2026-04-06
CVE-2026-35389 Bulwark Webmail S/MIME signature verification accepted self-signed certificates CWE-295 5.3AI Medium AI 2026-04-06
CVE-2026-35545 Roundcube Webmail 安全漏洞 CWE-669 5.3 Medium 2026-04-03

All 45 known CVE vulnerabilities affecting Webmail with full Chinese analysis, references, and POCs where available.