Login Request a demo
SO
Product
SOGo
by Alinto · last CVE Sep 17, 2026
18
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 0High 4Medium 13Low 1
Severity
All severities18Critical0High4Medium13Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add SOGo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2016-6188
6.5
2%
Feb 3
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to…
Affected: 2.3.7
CVE-2025-71276
6.1
0%
Mar 22
SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories
Affected: before 5.12.5
CVE-2026-3054
6.1
0%
Feb 24
Alinto SOGo cross site scripting
Affected: 5.12.3; 5.12.4
CVE-2025-63499
6.1
0%
Dec 4
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter
Affected: through 5.12.4
CVE-2025-63498
6.1
0%
Nov 24
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter
Affected: 5.12.3
CVE-2024-24510
6.1
0%
Sep 9
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component
Affected: before 5.10.0
CVE-2024-34462
6.1
0%
May 4
Alinto SOGo through 5.10.0 allows XSS during attachment preview
Affected: before 5.11.0
CVE-2023-48104
6.1
1%
Jan 16
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection
Affected: before 5.9.1
CVE-2022-4558
6.1
1%
Dec 16
A vulnerability was found in Alinto SOGo up to 5.7.1
Affected: before 5.8.0
CVE-2022-4556
6.1
1%
Dec 16
A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic
Affected: before 5.8.0
CVE-2016-6191
6.1
1%
Feb 17
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or…
Affected: through 3.1.2
CVE-2014-9905
6.1
1%
Feb 17
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an…
Affected: through 2.1.1
CVE-2016-6189
4.3
1%
Feb 17
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML…
Affected: before 2.3.12; 3.0.0 before 3.1.1
Showing 13