Login Request a demo
MA
Product
Mailman
by Gnu · last CVE Apr 20, 2025
47
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities47In the news0Timeline
Severity mix
Critical 0High 6Medium 11Low 0
Severity
All severities47Critical0High6Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mailman to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-43332
6.5
1%
Nov 12
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password
Affected: before 2.1.36
CVE-2020-12108
6.5
3%
May 6
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection
Affected: before 2.1.31
CVE-2018-13796
6.5
3%
Jul 12
An issue was discovered in GNU Mailman before 2.1.28
Affected: before 2.1.28
CVE-2021-34337
6.3
0%
Apr 15
An issue was discovered in Mailman Core before 3.3.5
Affected: before 3.3.5
CVE-2021-43331
6.1
1%
Nov 12
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS
Affected: before 2.1.36
CVE-2020-12137
6.1
2%
Apr 24
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts
Affected: 2.0 before 2.1.30
CVE-2018-5950
6.1
5%
Jan 23
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL
Affected: before 2.1.26
CVE-2018-0618
5.4
2%
Jul 26
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors
Affected: through 2.1.26
CVE-2025-43921
5.3
0%
Apr 20
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint
Affected: 2.1.1 through 2.1.39
CVE-2021-42096
4.3
1%
Oct 21
GNU Mailman before 2.1.35 may allow remote Privilege Escalation
Affected: before 2.1.35
CVE-2020-15011
4.3
2%
Jun 24
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page
Affected: before 2.1.33
Showing 11