alinto sogo vulnerabilities in 2026, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 5.3CVE-2026-127145EPSS 0.3%
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalen…
- 7.1CVE-2026-127141EPSS 0.3%
SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection bu…
- 5.3CVE-2026-127135EPSS 0.2%
SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed …
- 9.1CVE-2026-127131EPSS 0.3%
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attac…
- 7.1CVE-2026-127121EPSS 0.1%
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signa…
- 9.1CVE-2026-127111EPSS 0.3%
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecover…
- 8.7CVE-2026-93453EPSS 0.5%
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password reco…
- 7.1CVE-2026-46446EPSS 0.2%
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- 7.1CVE-2026-46445EPSS 0.2%
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- 2.6CVE-2026-33550EPSS 0.1%
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
- 6.1CVE-2025-71276EPSS 0.1%
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.
- 2.1CVE-2026-3054EPSS 0.5%
A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and…