SO
Product
SOGo
18
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 13Low 1
Watch
Add SOGo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5395 | 8.8 | Sep 20 | Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0 Affected: before 3.1.0 |
| CVE-2026-93453 | 8.3 | Sep 17 | SOGo before 5.12.11 Password Reset Token Interception via Origin Header Affected: before 5.12.11 |
| CVE-2026-46446 | 7.1 | May 14 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection Affected: before 5.12.7 |
| CVE-2026-46445 | 7.1 | May 14 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection Affected: before 5.12.7 |
| CVE-2016-6188 | 6.5 | Feb 3 | Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to… Affected: 2.3.7 |
| CVE-2025-71276 | 6.1 | Mar 22 | SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories Affected: before 5.12.5 |
| CVE-2026-3054 | 6.1 | Feb 24 | A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4 Affected: 5.12.3; 5.12.4 |
| CVE-2025-63499 | 6.1 | Dec 4 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter Affected: through 5.12.4 |
| CVE-2025-63498 | 6.1 | Nov 24 | alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter Affected: 5.12.3 |
| CVE-2024-24510 | 6.1 | Sep 9 | Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component Affected: before 5.10.0 |
| CVE-2024-34462 | 6.1 | May 4 | Alinto SOGo through 5.10.0 allows XSS during attachment preview Affected: before 5.11.0 |
| CVE-2023-48104 | 6.1 | Jan 16 | Alinto SOGo before 5.9.1 is vulnerable to HTML Injection Affected: before 5.9.1 |
| CVE-2022-4558 | 6.1 | Dec 16 | A vulnerability was found in Alinto SOGo up to 5.7.1 Affected: before 5.8.0 |
| CVE-2022-4556 | 6.1 | Dec 16 | A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic Affected: before 5.8.0 |
| CVE-2016-6191 | 6.1 | Feb 17 | Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or… Affected: through 3.1.2 |
| CVE-2014-9905 | 6.1 | Feb 17 | Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an… Affected: through 2.1.1 |
| CVE-2016-6189 | 4.3 | Feb 17 | Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML… Affected: before 2.3.12; 3.0.0 before 3.1.1 |
| CVE-2026-33550 | 2.6 | Mar 22 | SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended) Affected: before 5.12.5 |
Showing 18