AAlinto

Products

Exploited and recent CVEs

• CVE-2026-93453 High 8.3 SOGo before 5.12.11 Password Reset Token Interception via Origin Header 0.5%
• CVE-2026-8851 High 8.1 SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint 0.3%
• CVE-2026-46446 High 7.1 SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin. 0.2%
• CVE-2026-46445 High 7.1 SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. 0.2%
• CVE-2026-33550 Low 2.0 SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). 0.1%
• CVE-2025-71276 Medium 6.4 SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. 0.1%
• CVE-2026-3054 Medium 4.3 Alinto SOGo cross site scripting 0.5%
• CVE-2025-53603 High 7.5 In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a 0.7%
• CVE-2022-4556 Low 3.5 Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting 0.6%
• CVE-2022-4558 Low 3.5 Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting 0.6%