mailcow vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20233
3. 20247
4. 20252
5. 20267

Newest CVEs

• CVE-2026-7460

  mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

  mailcow · mailcow-dockerized

  High7.4
• CVE-2026-40878

  mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

  mailcow · mailcow-dockerized

  Low2.1
• CVE-2026-40875

  mailcow: dockerized vulnerable to stored XSS in user login history real_rip

  mailcow · mailcow-dockerized

  High7.0
• CVE-2026-40874

  mailcow: dockerized missing authorization on Forwarding Hosts delete action

  mailcow · mailcow-dockerized

  Medium6.0
• CVE-2026-40873

  mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames

  mailcow · mailcow-dockerized

  High8.9
• CVE-2026-40872

  mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

  mailcow · mailcow-dockerized

  Critical9.3
• CVE-2026-40871

  mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

  mailcow · mailcow-dockerized

  High7.2
• CVE-2025-53909

  mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

  mailcow · mailcow-dockerized

  Critical9.1
• CVE-2025-25198

  mailcow: dockerized vulnerable to password reset poisoning

  mailcow · mailcow-dockerized

  High7.1
• CVE-2024-41960

  Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized

  mailcow · mailcow-dockerized

  Low3.8