Alinto SOGo vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20266

Newest CVEs

• CVE-2026-93453

  SOGo before 5.12.11 Password Reset Token Interception via Origin Header

  Alinto · SOGo

  High8.7
• CVE-2026-46446

  SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in…

  Alinto · SOGo

  High7.1
• CVE-2026-46445

  SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

  Alinto · SOGo

  High7.1
• CVE-2026-33550

  SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

  Alinto · SOGo

  Low2.0
• CVE-2025-71276

  SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.

  Alinto · SOGo

  Medium6.4
• CVE-2026-3054

  Alinto SOGo cross site scripting

  Alinto · SOGo

  Medium5.3
• CVE-2022-4558

  Alinto SOGo Folder/Mail NSString+Utilities.m cross site scripting

  Alinto · SOGo

  Low3.5
• CVE-2022-4556

  Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

  Alinto · SOGo

  Low3.5