bulwarkmail webmail

• CVE-2026-113728 High 7.5 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint 0.5%
• CVE-2026-35391 High 8.7 Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery 0.1%
• CVE-2026-35390 Medium 6.1 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks 0.2%
• CVE-2026-35389 High 8.7 Bulwark Webmail S/MIME signature verification accepted self-signed certificates 0.2%
• CVE-2026-34834 High 8.7 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation 0.3%
• CVE-2026-34833 High 8.7 Bulwark Webmail: Information Exposure: password returned in /api/auth/session 0.2%