Vulnerabilities

Filters

1 selected

23 records

Sort

Vendor: mailcow Clear all filters

TI-2026-06557 CVE-2026-7460 · GHSA-4wpv-p8hj-wr36

mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

HIGH 68

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.0032 Published 2026-05-20 No fix listed CWE-79

TI-2026-29534 CVE-2026-40878

mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

LOW 13

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00805 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29531 CVE-2026-40875

mailcow: dockerized vulnerable to stored XSS in user login history real_rip

MEDIUM 64

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00238 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29530 CVE-2026-40874

mailcow: dockerized missing authorization on Forwarding Hosts delete action

MEDIUM 60

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0017 Published 2026-04-21 Fixed in 2026-03b CWE-284

TI-2026-29529 CVE-2026-40873

mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames

HIGH 74

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.0042 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29528 CVE-2026-40872

mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

HIGH 81

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00361 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29527 CVE-2026-40871

mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

HIGH 67

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.08565 Published 2026-04-21 Fixed in 2026-03b CWE-116

TI-2025-33781 CVE-2025-53909

mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00537 Published 2025-07-17 Fixed in 2025-07 CWE-1336

TI-2025-18867 CVE-2025-25198

mailcow: dockerized vulnerable to password reset poisoning

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01121 Published 2025-02-12 Fixed in 2025-01a CWE-601

TI-2024-27982 CVE-2024-41960

Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized

LOW 22

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2024-08-05 Fixed in 2024-07 CWE-79

TI-2024-27981 CVE-2024-41959

Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

LOW 33

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00352 Published 2024-08-05 Fixed in 2024-07 CWE-79

TI-2024-27980 CVE-2024-41958

Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

LOW 34

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01035 Published 2024-08-05 Fixed in 2024-07 CWE-697

TI-2024-20581 CVE-2024-31204

mailcow Cross-site Scripting Vulnerability via Exception Handler

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 6.1 Adjacent network Low privileges User interaction EPSS 0.08249 Published 2024-04-04 Fixed in 2024-04 CWE-79

TI-2024-20015 CVE-2024-30270

mailcow Path Traversal and Arbitrary Code Execution Vulnerability

MEDIUM 50

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.27346 Published 2024-04-04 Fixed in 2024-04 CWE-22

TI-2024-16277 CVE-2024-24760

Mailcow Docker Container Exposure to Local Network

MEDIUM 42

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00868 Published 2024-02-02 Fixed in 2024-01c CWE-610

TI-2024-15818 CVE-2024-23824

mailcow ipixel flood attack leads to Denial of Service in admin page

MEDIUM 55

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00597 Published 2024-02-02 Fixed in 2024-01 CWE-400

TI-2023-26742 CVE-2023-49077

mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

LOW 36

Mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00443 Published 2023-11-30 Fixed in 2023-11 CWE-79

TI-2023-16954 CVE-2023-34108

Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

MEDIUM 42

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00979 Published 2023-06-07 Fixed in 2023-05a CWE-78

TI-2023-11637 CVE-2023-26490

mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync

MEDIUM 48

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0222 Published 2023-03-03 Fixed in 2023-03 CWE-78

TI-2022-18634 CVE-2022-39258

mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

HIGH 71

mailcow is a mailserver suite.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.01832 Published 2022-09-27 Fixed in 2022-09 CWE-200

TI-2022-13182 CVE-2022-31138

OS Command Injection in mailcow

HIGH 73

mailcow is a mailserver suite.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0328 Published 2022-07-11 Fixed in 2022-06a CWE-78

TI-2022-13278 CVE-2022-31245 · GHSA-724h-f4rh-cc47

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and…

MEDIUM 47

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05566 Published 2022-05-20 No fix listed CWE-78

TI-2017-06420 CVE-2017-8928 · GHSA-5jvq-xmw7-69rm

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

MEDIUM 42

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02049 Published 2017-05-14 No fix listed CWE-352