{"schema_version":"1","data":[{"id":3698,"advisory_id":"379969fe-773f-4122-8fd7-1a0e5870d2cf","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-16651","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:47.275217+00:00","extraction_method":"structured","technologies":["core-kev","roundcube-webmail"],"cve_ids":["CVE-2017-16651"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Roundcube Webmail File Disclosure Vulnerability","summary":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-16651","products":[{"name":{"value":"Roundcube Webmail","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-16651","aliases":["CVE-2017-16651"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-552"],"cveID":"CVE-2017-16651","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","dueDate":"2022-05-03","product":"Roundcube Webmail","dateAdded":"2021-11-03","vendorProject":"Roundcube","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","vulnerabilityName":"Roundcube Webmail File Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-16651","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1309,"advisory_id":"7e41ce49-0b38-4a6d-abac-f088880bc13b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44026","source_published_at":"2023-06-22T00:00:00+00:00","published_at":"2026-10-24T20:59:26.312198+00:00","extraction_method":"structured","technologies":["core-kev","roundcube-webmail"],"cve_ids":["CVE-2021-44026"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Roundcube Webmail SQL Injection Vulnerability","summary":"Roundcube Webmail is vulnerable to SQL injection via search or search_params. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-44026","products":[{"name":{"value":"Roundcube Webmail","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-44026","aliases":["CVE-2021-44026"],"affected":[],"modified":"2023-06-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2021-44026","notes":"https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released; https://nvd.nist.gov/vuln/detail/CVE-2021-44026","dueDate":"2023-07-13","product":"Roundcube Webmail","dateAdded":"2023-06-22","vendorProject":"Roundcube","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Roundcube Webmail is vulnerable to SQL injection via search or search_params.","vulnerabilityName":"Roundcube Webmail SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-44026","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1308,"advisory_id":"9bfdbf79-1ad7-4bd9-83f7-e3393311db78","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-12641","source_published_at":"2023-06-22T00:00:00+00:00","published_at":"2026-10-24T20:59:25.735465+00:00","extraction_method":"structured","technologies":["core-kev","roundcube-webmail"],"cve_ids":["CVE-2020-12641"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Roundcube Webmail Remote Code Execution Vulnerability","summary":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-12641","products":[{"name":{"value":"Roundcube Webmail","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-12641","aliases":["CVE-2020-12641"],"affected":[],"modified":"2023-06-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-78"],"cveID":"CVE-2020-12641","notes":"https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641","dueDate":"2023-07-13","product":"Roundcube Webmail","dateAdded":"2023-06-22","vendorProject":"Roundcube","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.","vulnerabilityName":"Roundcube Webmail Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-12641","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1307,"advisory_id":"082b8bd7-bdac-4440-a484-260185241dba","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-35730","source_published_at":"2023-06-22T00:00:00+00:00","published_at":"2026-10-24T20:59:25.141545+00:00","extraction_method":"structured","technologies":["core-kev","roundcube-webmail"],"cve_ids":["CVE-2020-35730"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","summary":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-35730","products":[{"name":{"value":"Roundcube Webmail","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-35730","aliases":["CVE-2020-35730"],"affected":[],"modified":"2023-06-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-79"],"cveID":"CVE-2020-35730","notes":"https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13; https://nvd.nist.gov/vuln/detail/CVE-2020-35730","dueDate":"2023-07-13","product":"Roundcube Webmail","dateAdded":"2023-06-22","vendorProject":"Roundcube","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.","vulnerabilityName":"Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-35730","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}}],"next_after":3698,"next_before":1307}