CVE-20XX-?

CVE-2025-68461

7.2 HIGH 27% exploit odds exploited in the wild Fix listed XSS Browser & mail

What it is

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

At a glance

Exploitability
Can be exploited over the network without logging in. Limited direct impact.
In the wild
CISA lists this as exploited in real attacks. Treat as urgent.
Fix
A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

  1. ReservedThe CVE id was reserved by its CNA
  2. PublishedDisclosed publicly on CVE.org and NVD
  3. 2026-02-20 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
  4. 2026-03-13 Remediation deadlineCISA's due date for federal agencies to fix it
  5. Last updatedMost recent change to the record

Details

Published
Last modified
Added to CISA KEV
2026-02-20
Exploit probability
27.4% · EPSS, next 30 days
Weakness
CWE-79 · Cross-site scripting
Record status
Analyzed

Affected

Attack profile CVSS 3.1 · 7.2

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Meme: I wake up, CVE-2025-68461
Download Square Reddit

Fix and advisories

References

NVD record · CVE.org record