Roundcube

Roundcube is a widely deployed, browser-based webmail client embedded in mail hosting infrastructure and control panels across a large installed base, despite its narrow product portfolio. Vulnerabilities affecting the vendor skew toward serious outcomes and have an elevated tendency to be confirmed as exploited in the wild and cataloged by CISA, while public exploit code and proof-of-concept tooling frequently accompany disclosures. The recurring exposure centers on the webmail interface and clusters around input sanitization failures—particularly cross-site scripting and CSRF—alongside information-disclosure and path-traversal weaknesses that are characteristic of server-side web applications handling user-controlled input and file operations. Defenders should treat this vendor's advisories as high-priority for any internet-facing or hosted mail deployment and inventory instances that may be running unpatched versions; live severity and exploitation counts are shown alongside this summary.