Alinto SOGo

• CVE-2026-93453 High 8.3 SOGo before 5.12.11 Password Reset Token Interception via Origin Header 0.5%
• CVE-2026-46446 High 7.1 SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin. 0.2%
• CVE-2026-46445 High 7.1 SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. 0.2%
• CVE-2026-33550 Low 2.0 SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). 0.1%
• CVE-2025-71276 Medium 6.4 SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. 0.1%
• CVE-2026-3054 Medium 4.3 Alinto SOGo cross site scripting 0.5%
• CVE-2022-4558 Low 3.5 Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting 0.6%
• CVE-2022-4556 Low 3.5 Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting 0.6%