PatchTheCVEwebmail vulnerabilities and fixes
Recent CVEs affecting webmail, with upgrade or downgrade steps. 5 tracked.
webmail has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-07-14. Highest priority: CVE-2026-54433 (score 36/100).
- CVE-2026-54433 HIGH 7.2 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a cr
- CVE-2026-62643 HIGH 7.2 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitizat
- CVE-2026-62644 MEDIUM 6.4 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was su
- CVE-2026-62642 MEDIUM 4.3 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder
- CVE-2026-62641 MEDIUM 4.3 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service v
FAQ
How do I fix webmail vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is webmail being exploited right now?
None of the tracked webmail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which webmail CVE should I patch first?
CVE-2026-54433 currently ranks highest (36/100): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a cr.