{
  "fix": "OPENSUSE-SU-2026:22195-1",
  "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22195-1",
  "summary": "OPENSUSE-SU-2026:22195-1, released November 7, 2026, fixes 18 CVEs in roundcubemail (version 1.6.20-bp160.1.1). One of them is being exploited (CVE-2025-49113); 1 on CISA KEV. Patch Radar priority: Patch now.",
  "platform": "linux",
  "type": "advisory",
  "title": "roundcubemail security update",
  "released": "2026-11-07T00:47:19Z",
  "priority": "Patch now",
  "priorityTier": 1,
  "priorityReason": "Closes CVE-2025-49113, exploited (CISA KEV)",
  "supported": true,
  "cveCount": 18,
  "exploitedCveCount": 1,
  "kevCveCount": 1,
  "ransomwareCveCount": 0,
  "maxEpss": 0.99604,
  "maxCvss": 10,
  "vendorAdvisory": "https://osv.dev/vulnerability/openSUSE-SU-2026:22195-1",
  "appliesTo": [
    {
      "product": "roundcubemail",
      "productUrl": "https://patchblox.com/security/product/linux/roundcubemail",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.6.20-bp160.1.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2025-49113",
      "url": "https://patchblox.com/security/cve/CVE-2025-49113",
      "title": "roundcube: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote codeexecution by authenticated users because th...",
      "priority": "Patch now",
      "severity": "High",
      "cvss": 8.8,
      "epss": 0.99604,
      "kev": true,
      "ransomware": false,
      "exploited": true,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75003",
      "url": "https://patchblox.com/security/cve/CVE-2026-75003",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image c...",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 9.8,
      "epss": 0.00478,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-54433",
      "url": "https://patchblox.com/security/cve/CVE-2026-54433",
      "title": "roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted p...",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 10,
      "epss": 0.00374,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-62643",
      "url": "https://patchblox.com/security/cve/CVE-2026-62643",
      "title": "roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in...",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 10,
      "epss": 0.00295,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-62644",
      "url": "https://patchblox.com/security/cve/CVE-2026-62644",
      "title": "roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject t...",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 9.8,
      "epss": 0.00259,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75002",
      "url": "https://patchblox.com/security/cve/CVE-2026-75002",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL\u002B byte-count desynchronization coul...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.1,
      "epss": 0.01356,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-113386",
      "url": "https://patchblox.com/security/cve/CVE-2026-113386",
      "title": "roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection",
      "priority": "High",
      "severity": "high",
      "cvss": 7.1,
      "epss": 0.01004,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-74997",
      "url": "https://patchblox.com/security/cve/CVE-2026-74997",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject t...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.00784,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75007",
      "url": "https://patchblox.com/security/cve/CVE-2026-75007",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unesca...",
      "priority": "High",
      "severity": "high",
      "cvss": 8.8,
      "epss": 0.00353,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-74998",
      "url": "https://patchblox.com/security/cve/CVE-2026-74998",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were...",
      "priority": "High",
      "severity": "high",
      "cvss": 7.2,
      "epss": 0.00322,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75006",
      "url": "https://patchblox.com/security/cve/CVE-2026-75006",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 5.8,
      "epss": 0.00416,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75000",
      "url": "https://patchblox.com/security/cve/CVE-2026-75000",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate \u0022by\u0022 att...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 5.8,
      "epss": 0.00346,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75010",
      "url": "https://patchblox.com/security/cve/CVE-2026-75010",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Mod...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 4.3,
      "epss": 0.00285,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-62642",
      "url": "https://patchblox.com/security/cve/CVE-2026-62642",
      "title": "roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 6.5,
      "epss": 0.00277,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75004",
      "url": "https://patchblox.com/security/cve/CVE-2026-75004",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disab...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 4.3,
      "epss": 0.00274,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-74999",
      "url": "https://patchblox.com/security/cve/CVE-2026-74999",
      "title": "roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the \u0022Add to address book\u0022 action was subject to stored XSS.",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 5.4,
      "epss": 0.0026,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-62641",
      "url": "https://patchblox.com/security/cve/CVE-2026-62641",
      "title": "roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a cr...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 6.5,
      "epss": 0.00252,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-54432",
      "url": "https://patchblox.com/security/cve/CVE-2026-54432",
      "title": "roundcube: Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS)",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 4.7,
      "epss": 0.00221,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-10T20:03:11Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}