Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
36 results
Sep 30, 2026sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES".CVE-2026-74865 · Other software · YunoHost-Apps · reported by cvd@cert.plCritical 9.2
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.
- Product
- sogo_yhn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plforum.yunohost.org
Sep 30, 2026sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without pCVE-2026-74864 · Other software · YunoHost-Apps · reported by cvd@cert.plCritical 9.3
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.
- Product
- sogo_yhn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plforum.yunohost.org
Sep 17, 2026SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recCVE-2026-93453 · Other software · Alinto · reported by VulnCheckHigh 8.7
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe componentCVE-2026-51990 · Other software · reported by MITRECritical 9.8
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsogou.comgendigital.com
Aug 30, 2026SOGO Add Script to Individual Pages Header Footer: Does not sanitise or escape the custom header/footer script values saved from its post metaboxCVE-2026-14835 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
- Product
- SOGO Add Script to Individual Pages Header Footer
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update SOGO Add Script to Individual Pages Header Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 8, 2026A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the passwordCVE-2026-39179 · Other software · reported by MITREMedium 6.3
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSeaCVE-2026-39178 · Other software · reported by MITREMedium 6.3
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extCVE-2026-8851 · Other software · Alinto · reported by VulnCheckHigh 8.6
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
- Product
- SOGo Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection.CVE-2026-46446 · Other software · Alinto · reported by MITREHigh 7.1
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commail-archive.com
May 14, 2026SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.CVE-2026-46445 · Other software · Alinto · reported by MITREHigh 7.1
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commail-archive.com
May 13, 2026A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7.CVE-2026-8496 · Other software · Alinto SOGo · reported by cret@cert.orgMedium 6.1
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).CVE-2026-33550 · Other software · Alinto · reported by MITRELow 2
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.CVE-2025-71276 · Other software · Alinto · reported by MITREMedium 6.4
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4.CVE-2026-3054 · Other software · Alinto · reported by VulDBLow 2.1
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.CVE-2025-63499 · Other software · Alinto · reported by MITREMedium 6.1
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemail.example.comgithub.com
Nov 24, 2025alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.CVE-2025-63498 · Other software · Alinto · reported by MITREMedium 6.1
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of oCVE-2025-50340 · Other software · reported by MITREMedium 4.3
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server fails to verify whether the authenticated user is authorized to use the specified sender identity, resulting in unauthorized message delivery as another user. This can lead to impersonation, phishing, or unauthorized communication within the system. NOTE: this is disputed by the Supplier because the only effective way to prevent this sender spoofing is on the SMTP server, not within a client such as SOGo.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Jul 4, 2025In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameterCVE-2025-53603 · Other software · Alinto · reported by MITREHigh 7.5
In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.
- Product
- SOPE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted lCVE-2024-56963 · Other software · reported by MITREMedium 6.5
An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail componentCVE-2024-24510 · Other software · Alinto · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbook.hacktricks.xyzgithub.com
May 4, 2024Alinto SOGo through 5.10.0 allows XSS during attachment preview.CVE-2024-34462 · Other software · alinto · reported by MITREMedium 6.1
Alinto SOGo through 5.10.0 allows XSS during attachment preview.
- Product
- sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.CVE-2023-48104 · Other software · Alinto · reported by MITREMedium 6.1
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containiCVE-2020-22402 · Other software · Alinto · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code.
- Product
- Sogo Web Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.CVE-2023-33457 · Other software · Sogou · reported by MITREHigh 8.8
In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.
- Product
- C++ Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE).CVE-2023-27527 · Other software · The Ministry of Justice · reported by vultures@jpcert.or.jpHigh 7.5
Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
- Product
- Shinseiyo Sogo Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jptouki-kyoutaku-online.moj.go.jp
Dec 16, 2022A vulnerability was found in Alinto SOGo up to 5.7.1.CVE-2022-4558 · Other software · Alinto · reported by VulDBLow 3.5
A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is 1e0f5f00890f751e84d67be4f139dd7f00faa5f3. It is recommended to upgrade the affected component. The identifier VDB-215961 was assigned to this vulnerability.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic.CVE-2022-4556 · Other software · Alinto · reported by VulDBLow 3.5
A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives.CVE-2021-33054 · Other software · Inverse · reported by MITREHigh 7.5
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.akamai.comgithub.com
Sep 20, 2017Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.CVE-2015-5395 · Other software · Debian · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jul 7, 2017Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft (4.8A) and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unCVE-2017-2232 · Other software · The Ministry of Justice · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft (4.8A) and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of Shinseiyo Sogo Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2017Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrCVE-2016-6191 · Other software · Alinto · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 17, 2017SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive CVE-2016-6190 · Other software · Inverse-inc · reported by MITREMedium 4.3
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 17, 2017Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (CVE-2016-6189 · Other software · Alinto · reported by MITREMedium 4.3
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 17, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via tCVE-2014-9905 · Other software · Alinto · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Feb 3, 2017Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment,CVE-2016-6188 · Other software · Alinto · reported by MITREMedium 6.5
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporary files.
- Product
- Sogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 30, 2004Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.CVE-2004-1771 · Other software · Open Group · reported by MITREMedium 5
Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.
- Product
- Scalable OGO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.opengroupware.orgsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.