What’s Vulnerable › Products

bulwarkmail webmail vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your bulwarkmail webmail version is affected

Latest bulwarkmail webmail vulnerabilities

• CVE-2026-113728 — Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint (CVSS 7.5)
• CVE-2026-35391 — Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery (CVSS 7.5)
• CVE-2026-35390 — Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks (CVSS 5.4)
• CVE-2026-35389 — Bulwark Webmail S/MIME signature verification accepted self-signed certificates (CVSS 7.5)
• CVE-2026-34834 — Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation (CVSS 7.5)
• CVE-2026-34833 — Bulwark Webmail: Information Exposure: password returned in /api/auth/session (CVSS 7.5)