Mailcow vulnerabilities

Products

• Mailcow-dockerized 21
• Mailcow\ 16

Newest

• mailcow mailcow-dockerized mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped CVE-2026-7460 7.4 HighMay 20, 2026
• mailcow mailcow-dockerized mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping CVE-2026-40878 2.1 LowApril 21, 2026
• mailcow mailcow-dockerized mailcow: dockerized vulnerable to stored XSS in user login history real_rip CVE-2026-40875 7.0 HighApril 21, 2026
• mailcow mailcow-dockerized mailcow: dockerized missing authorization on Forwarding Hosts delete action CVE-2026-40874 6.0 MediumApril 21, 2026
• mailcow mailcow-dockerized mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames CVE-2026-40873 8.9 HighApril 21, 2026
• mailcow mailcow-dockerized mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field CVE-2026-40872 9.3 CriticalApril 21, 2026
• mailcow mailcow-dockerized mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API CVE-2026-40871 7.2 HighApril 21, 2026
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template CVE-2025-53909 9.1 CriticalJuly 17, 2025
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow: dockerized vulnerable to password reset poisoning CVE-2025-25198 Public exploit 7.1 HighFebruary 12, 2025
• mailcow mailcow-dockerized, mailcow\ +1 more Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized CVE-2024-41960 3.8 LowAugust 5, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more Cross-site Scripting (XSS) via API Logs in mailcow: dockerized CVE-2024-41959 7.6 HighAugust 5, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more Two-Factor Authentication (2FA) Bypass in mailcow: dockerized CVE-2024-41958 Public exploit 6.6 MediumAugust 5, 2024
• mailcow dockerized, mailcow-dockerized, mailcow\ +2 more mailcow Cross-site Scripting Vulnerability via Exception Handler CVE-2024-31204 6.1 MediumApril 4, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow Path Traversal and Arbitrary Code Execution Vulnerability CVE-2024-30270 Public exploit EPSS 27.3% 6.2 MediumApril 4, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more Mailcow Docker Container Exposure to Local Network CVE-2024-24760 Public exploit 8.8 HighFebruary 2, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow ipixel flood attack leads to Denial of Service in admin page CVE-2024-23824 4.7 MediumFebruary 2, 2024
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation CVE-2023-49077 8.3 HighNovember 30, 2023
• mailcow mailcow-dockerized, mailcow\ +1 more Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords CVE-2023-34108 8.8 HighJune 7, 2023
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​ CVE-2023-26490 7.3 HighMarch 3, 2023
• mailcow mailcow-dockerized, mailcow\ +1 more mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI CVE-2022-39258 8.1 HighSeptember 27, 2022
• mailcow mailcow-dockerized, mailcow\ +1 more OS Command Injection in mailcow CVE-2022-31138 Public exploit 8.8 HighJuly 11, 2022
• mailcow mailcow\ mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate... CVE-2022-31245 Public exploit 8.8 HighMay 20, 2022
• mailcow mailcow\ mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. CVE-2017-8928 Public exploit 8.8 HighMay 14, 2017