Skip to contentMailcow Mailcow\ vulnerabilities
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification TemplateCVE-2025-539099.1 Critical
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow: dockerized vulnerable to password reset poisoningCVE-2025-25198Public exploit7.1 High
- mailcow mailcow-dockerized, mailcow\ +1 moreCross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerizedCVE-2024-419603.8 Low
- mailcow mailcow-dockerized, mailcow\ +1 moreCross-site Scripting (XSS) via API Logs in mailcow: dockerizedCVE-2024-419597.6 High
- mailcow mailcow-dockerized, mailcow\ +1 moreTwo-Factor Authentication (2FA) Bypass in mailcow: dockerizedCVE-2024-41958Public exploit6.6 Medium
- mailcow dockerized, mailcow-dockerized, mailcow\ +2 moremailcow Cross-site Scripting Vulnerability via Exception HandlerCVE-2024-312046.1 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow Path Traversal and Arbitrary Code Execution VulnerabilityCVE-2024-30270Public exploitEPSS 27.3%6.2 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moreMailcow Docker Container Exposure to Local NetworkCVE-2024-24760Public exploit8.8 High
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow ipixel flood attack leads to Denial of Service in admin pageCVE-2024-238244.7 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data ManipulationCVE-2023-490778.3 High
- mailcow mailcow-dockerized, mailcow\ +1 moreManipulation of Internal Dovecot Variables in mailcow via crafted PasswordsCVE-2023-341088.8 High
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow is vulnerable to shell command injection via xoauth2 authentication in imapsyncCVE-2023-264907.3 High
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UICVE-2022-392588.1 High
- mailcow mailcow-dockerized, mailcow\ +1 moreOS Command Injection in mailcowCVE-2022-31138Public exploit8.8 High
- mailcow mailcow\mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate...CVE-2022-31245Public exploit8.8 High
- mailcow mailcow\mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.CVE-2017-8928Public exploit8.8 High