What’s Vulnerable › Products
mailcow-dockerized vulnerabilities
23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your mailcow-dockerized version is affected
Latest mailcow-dockerized vulnerabilities
- CVE-2026-7460 — mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped (CVSS 7.4)
- CVE-2026-40878 — mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping (CVSS 2.1)
- CVE-2026-40875 — mailcow: dockerized vulnerable to stored XSS in user login history real_rip (CVSS 7.0)
- CVE-2026-40874 — mailcow: dockerized missing authorization on Forwarding Hosts delete action (CVSS 6.0)
- CVE-2026-40873 — mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames (CVSS 8.9)
- CVE-2026-40872 — mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field (CVSS 9.3)
- CVE-2026-40871 — mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API (CVSS 7.2)
- CVE-2025-53909 — mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template (CVSS 7.2)
- CVE-2025-25198 — mailcow: dockerized vulnerable to password reset poisoning (CVSS 8.8)
- CVE-2024-41960 — Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized (CVSS 4.8)
- CVE-2024-41959 — Cross-site Scripting (XSS) via API Logs in mailcow: dockerized (CVSS 6.1)
- CVE-2024-41958 — Two-Factor Authentication (2FA) Bypass in mailcow: dockerized (CVSS 7.2)
- CVE-2024-31204 — mailcow Cross-site Scripting Vulnerability via Exception Handler (CVSS 6.1)
- CVE-2024-30270 — mailcow Path Traversal and Arbitrary Code Execution Vulnerability (CVSS 6.2)
- CVE-2024-24760 — Mailcow Docker Container Exposure to Local Network (CVSS 7.3)
- CVE-2024-23824 — mailcow ipixel flood attack leads to Denial of Service in admin page (CVSS 2.7)
- CVE-2023-49077 — mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation (CVSS 6.1)
- CVE-2023-34108 — Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords (CVSS 8.8)
- CVE-2023-26490 — mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync (CVSS 8.8)
- CVE-2022-39258 — mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI (CVSS 8.2)
- CVE-2022-31138 — OS Command Injection in mailcow (CVSS 8.8)
- CVE-2022-31245 — (CVSS 8.8)
- CVE-2017-8928 — (CVSS 8.8)