Linux · 
openSUSE Leap · Security advisory · November 7, 2026
openSUSE Leap · Security advisory · November 7, 2026OPENSUSE-SU-2026:22195-1: roundcubemail security update
OPENSUSE-SU-2026:22195-1, released November 7, 2026, fixes 18 CVEs in roundcubemail (version 1.6.20-bp160.1.1). One of them is being exploited (CVE-2025-49113); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
18
4 rated Critical
Exploited
1
CVE-2025-49113
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.9960
99th percentile
Priority of the 18 CVEs
Patch now 1
Urgent 4
High 5
Routine 8
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| roundcubemail | opensuse-leap 16.0 | 1.6.20-bp160.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2025-49113 | roundcube: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote codeexecution by authenticated users because th... | 8.8 | 0.9960 | KEVExploited |
| Urgent | CVE-2026-75003 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image c... | 9.8 | 0.0048 | None reported |
| Urgent | CVE-2026-54433 | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted p... | 10.0 | 0.0037 | None reported |
| Urgent | CVE-2026-62643 | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in... | 10.0 | 0.0030 | None reported |
| Urgent | CVE-2026-62644 | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject t... | 9.8 | 0.0026 | None reported |
| High | CVE-2026-75002 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization coul... | 7.1 | 0.0136 | None reported |
| High | CVE-2026-113386 | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection | 7.1 | 0.0100 | None reported |
| High | CVE-2026-74997 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject t... | 8.8 | 0.0078 | None reported |
| High | CVE-2026-75007 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unesca... | 8.8 | 0.0035 | None reported |
| High | CVE-2026-74998 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were... | 7.2 | 0.0032 | None reported |
| Routine | CVE-2026-75006 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in... | 5.8 | 0.0042 | None reported |
| Routine | CVE-2026-75000 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" att... | 5.8 | 0.0035 | None reported |
| Routine | CVE-2026-75010 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Mod... | 4.3 | 0.0029 | None reported |
| Routine | CVE-2026-62642 | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which... | 6.5 | 0.0028 | None reported |
| Routine | CVE-2026-75004 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disab... | 4.3 | 0.0027 | None reported |
| Routine | CVE-2026-74999 | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. | 5.4 | 0.0026 | None reported |
| Routine | CVE-2026-62641 | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a cr... | 6.5 | 0.0025 | None reported |
| Routine | CVE-2026-54432 | roundcube: Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) | 4.7 | 0.0022 | None reported |
Showing 1 to 18 of 18
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.