Vulnerabilities

TI-2026-27527 CVE-2026-35391

Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling…

LOW 37

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00138 Published 2026-04-06 Fixed in 1.4.11 CWE-348

TI-2026-27526 CVE-2026-35390

LOW 23

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00173 Published 2026-04-06 Fixed in 1.4.11 CWE-79

TI-2026-27525 CVE-2026-35389

LOW 37

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00181 Published 2026-04-06 Fixed in 1.4.11 CWE-295

TI-2026-27078 CVE-2026-34834

MEDIUM 43

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00256 Published 2026-04-02 Fixed in 1.4.10 CWE-287

TI-2026-27077 CVE-2026-34833

MEDIUM 43

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00173 Published 2026-04-02 Fixed in 1.4.10 CWE-312