Mmailcow

Products

Exploited and recent CVEs

• CVE-2026-7460 High 7.4 mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped 0.3%
• CVE-2026-40878 Low 2.1 mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping 0.8%
• CVE-2026-40875 High 7.0 mailcow: dockerized vulnerable to stored XSS in user login history real_rip 0.2%
• CVE-2026-40874 Medium 6.0 mailcow: dockerized missing authorization on Forwarding Hosts delete action 0.2%
• CVE-2026-40873 High 8.9 mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames 0.4%
• CVE-2026-40872 Critical 9.3 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field 0.4%
• CVE-2026-40871 High 7.2 mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API 8.6%
• CVE-2025-53909 Critical 9.1 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template 0.5%
• CVE-2025-25198 High 7.1 mailcow: dockerized vulnerable to password reset poisoning 1.1%
• CVE-2024-41960 Low 3.8 Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized 0.3%
• CVE-2024-41959 High 7.6 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized 0.4%
• CVE-2024-41958 Medium 6.6 Two-Factor Authentication (2FA) Bypass in mailcow: dockerized 1.0%
• CVE-2024-31204 Medium 6.1 mailcow Cross-site Scripting Vulnerability via Exception Handler 8.2%
• CVE-2024-30270 Medium 6.2 mailcow Path Traversal and Arbitrary Code Execution Vulnerability 27.3%
• CVE-2024-24760 High 8.8 Mailcow Docker Container Exposure to Local Network 0.9%
• CVE-2024-23824 Medium 4.7 mailcow ipixel flood attack leads to Denial of Service in admin page 0.6%
• CVE-2023-49077 High 8.3 mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation 0.4%
• CVE-2023-34108 High 8.8 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords 1.0%
• CVE-2023-26490 High 7.3 mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​ 2.2%
• CVE-2022-39258 High 8.1 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI 1.8%
• CVE-2022-31138 High 8.8 OS Command Injection in mailcow 3.3%