Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
May 20, 2026mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.CVE-2026-7460 · Other software · mailcow · reported by help@fluidattacks.comHigh 7.4
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40878 · Other software · mailcow · reported by GitHubLow 2.1
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40875 · Other software · mailcow · reported by GitHubHigh 7
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser tab. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40874 · Other software · mailcow · reported by GitHubMedium 6
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40873 · Other software · mailcow · reported by GitHubHigh 8.9
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40872 · Other software · mailcow · reported by GitHubCritical 9.3
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2026-40871 · Other software · mailcow · reported by GitHubHigh 7.2
mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2025-53909 · Other software · mailcow · reported by GitHubCritical 9.1
mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2025-25198 · Other software · mailcow · reported by GitHubHigh 7.1
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2024-41960 · Other software · mailcow · reported by GitHubLow 3.8
mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scripts in the context of the user's browser. This could lead to data theft, or further exploitation. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2024-41959 · Other software · mailcow · reported by GitHubHigh 7.6
mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the user's browser. This could lead to unauthorized actions, data theft, or further exploitation of the affected system. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2024-41958 · Other software · mailcow · reported by GitHubMedium 6.6
mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accounts that are otherwise secured with 2FA. To exploit this vulnerability, the attacker must first have access to an account within the system and possess the credentials of the target account that has 2FA enabled. By leveraging these credentials, the attacker can circumvent the 2FA process and gain access to the protected account. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2024-31204 · Other software · mailcow · reported by GitHubMedium 6.1
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEV_MODE. The system saves exception details into a session array without proper sanitization or encoding. These details are later rendered into HTML and executed in a JavaScript block within the user's browser, without adequate escaping of HTML entities. This flaw allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input. The exploitation method involves using any function that might throw an exception with user-controllable argument. This issue can lead to session hijacking and unauthorized administrative actions, posing a significant security risk. Version 2024-04 contains a fix for the issue.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Apr 4, 2024mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2024-30270 · Other software · mailcow · reported by GitHubMedium 6.2
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()` function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commailcow.email
Feb 2, 2024mailcow is a dockerized email package, with multiple containers linked in one bridged network.CVE-2024-24760 · Other software · mailcow · reported by GitHubHigh 8.8
mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024mailcow is a dockerized email package, with multiple containers linked in one bridged network.CVE-2024-23824 · Other software · mailcow · reported by GitHubMedium 4.7
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Mailcow: dockerized is an open source groupware/email suite based on docker.CVE-2023-49077 · Other software · mailcow · reported by GitHubHigh 8.3
Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration.CVE-2023-34108 · Other software · mailcow · reported by GitHubHigh 8.8
mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which is responsible for verifying user passwords during login attempts. Upon a successful login, the script returns a response in the format of "password=<valid-password>", indicating the successful authentication. By crafting a password with additional key-value pairs appended to it, an attacker can manipulate the returned string and influence the internal behavior of Dovecot. For example, using the password "123 mail_crypt_save_version=0" would cause the `passwd-verify.lua` script to return the string "password=123 mail_crypt_save_version=0". Consequently, Dovecot will interpret this string and set the internal variables accordingly, leading to unintended consequences. This vulnerability can be exploited by an authenticated attacker who has the ability to set their own password. S
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023mailcow is a dockerized email package, with multiple containers linked in one bridged network.CVE-2023-26490 · Other software · mailcow · reported by GitHubHigh 7.3
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. Notably, the default ACL for a newly-created mailcow account does not include the necessary permission. The Issue has been fixed within the 2023-03 Update (March 3rd 2023). As a temporary workaround the Syncjob ACL can be removed from all mailbox users, preventing from creating or changing existing Syncjobs.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022mailcow is a mailserver suite.CVE-2022-39258 · Other software · mailcow · reported by GitHubHigh 8.1
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022mailcow is a mailserver suite.CVE-2022-31138 · Other software · mailcow · reported by GitHubHigh 8.8
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.