Composer roundcube/roundcubemail has 10 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-49113 KEV | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical | 9.9 | <1.5.10 or >=1.6.0 and <1.6.11 | 1.5.10, 1.6.11 |
| CVE-2026-35537 | Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler | low | 3.7 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35538 | Roundcube Webmail: Unsanitized IMAP SEARCH command arguments | low | 3.1 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35542 | Roundcube: Bypass of remote image blocking via crafted BODY background attribute | medium | 5.3 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35543 | Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message | medium | 5.3 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35545 | Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message | medium | 5.3 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35540 | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.4 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35544 | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.3 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35539 | Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode | medium | 6.1 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
| CVE-2026-35541 | Roundcube Webmail: Incorrect password comparison in the password plugin | medium | 4.2 | >=1.7-beta and <1.7-rc5 | 1.7-rc5 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked