Skip to contentAlinto Sogo Sogo vulnerabilities
- alinto sogoSOGo before 5.12.13 SSRF via Web Calendar SubscriptionsCVE-2026-1271455.3 Medium
- alinto sogoSOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting WaitCVE-2026-1271417.1 High
- alinto sogoSOGo before 5.12.13 Sieve Script Injection via Notification AddressCVE-2026-1271355.3 Medium
- alinto sogoSOGo before 5.12.13 Missing Rate Limiting on TOTP VerificationCVE-2026-1271319.1 Critical
- alinto sogoSOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailViewCVE-2026-1271217.1 High
- alinto sogoSOGo before 5.12.13 Unauthenticated Password Recovery Brute ForceCVE-2026-1271119.1 Critical
- alinto sogoSOGo before 5.12.11 Password Reset Token Interception via Origin HeaderCVE-2026-93453Public exploitFix available8.7 High
- alinto sogoSOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored,...CVE-2026-46446Fix available7.1 High
- alinto sogoSOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.CVE-2026-46445Fix available7.1 High
- alinto sogo sogoA cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7CVE-2026-8496Fix available6.1 Medium
- alinto sogoSOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short...CVE-2026-33550Fix available2.0 Low
- alinto sogoSOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.CVE-2025-71276Fix available6.4 Medium
- alinto sogoAlinto SOGo cross site scriptingCVE-2026-3054Fix available5.3 Medium
- alinto sogoAlinto SOGo Folder/Mail NSString+Utilities.m cross site scriptingCVE-2022-4558Fix available3.5 Low
- alinto sogoAlinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scriptingCVE-2022-4556Public exploitFix available3.5 Low