Horde
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| IMP | 3 | – | Aug 24, 2026 |
| Groupware Webmail Edition | 2 | – | Mar 23, 2020 |
| Groupware | 1 | – | Dec 2, 2025 |
| Vfs | 1 | – | Jul 8, 2026 |
Exploited and recent CVEs
- CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name 0.4%
- CVE-2026-60102 Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver 3.3%
- CVE-2026-58451 Horde IMP < 7.0.1 Path Traversal via Compose.php img src 0.6%
- CVE-2025-41066 Disclosure of sensitive information in Horde Groupware 0.3%
- CVE-2025-30349 Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may 31.3%
- CVE-2020-8866 This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The 9.6%
- CVE-2020-8865 This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The 6.8%