OG
Vendor
Open-Xchange GmbH
75
CVEs
0
On KEV
0
New 30D
Products
OD9.1
OX Dovecot Pro
Open-Xchange GmbH
44 CVEs0 on KEV0 new
OD9.1
OX Dovecot CE
Open-Xchange GmbH
25 CVEs0 on KEV0 new
OA7.5
OX App Suite
Open-Xchange GmbH
6 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73209 | OD OX Dovecot Pro Open-Xchange GmbH | 6.5 | Aug 28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash |
| CVE-2026-73208 | OD OX Dovecot Pro Open-Xchange GmbH | 7.4 | Aug 28 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used… |
| CVE-2026-52687 | OD OX Dovecot Pro Open-Xchange GmbH | 6.5 | Aug 28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several… |
| CVE-2026-52681 | OD OX Dovecot Pro Open-Xchange GmbH | 3.1 | Aug 28 | Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script |
| CVE-2026-42395 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Aug 28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt |
| CVE-2026-42393 | OD OX Dovecot CE Open-Xchange GmbH | 3.1 | Aug 28 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret |
| CVE-2026-42392 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Aug 28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client |
| CVE-2026-42391 | OD OX Dovecot CE Open-Xchange GmbH | 7.5 | Aug 28 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately |
| CVE-2026-42008 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Aug 28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected… |
| CVE-2026-42007 | OD OX Dovecot CE Open-Xchange GmbH | 9.1 | Aug 28 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents… |
| CVE-2026-40205 | OD OX Dovecot CE Open-Xchange GmbH | 5.9 | Aug 28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote… |
| CVE-2026-40204 | OD OX Dovecot Pro Open-Xchange GmbH | 3.1 | Aug 28 | None None None No publicly available exploits are known |
| CVE-2026-40203 | OD OX Dovecot Pro Open-Xchange GmbH | 3.7 | Aug 28 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the… |
| CVE-2026-40019 | OD OX Dovecot CE Open-Xchange GmbH | 5.9 | Aug 28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU |
| CVE-2026-40018 | OD OX Dovecot CE Open-Xchange GmbH | 7.4 | Aug 28 | None None None No publicly available exploits are known |
| CVE-2026-40017 | OD OX Dovecot CE Open-Xchange GmbH | 6.5 | Aug 28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU… |
| CVE-2026-40015 | OD OX Dovecot CE Open-Xchange GmbH | 4.3 | Aug 28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and… |
| CVE-2026-40014 | OD OX Dovecot CE Open-Xchange GmbH | 6.5 | Aug 28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message |
| CVE-2026-40013 | OD OX Dovecot CE Open-Xchange GmbH | 4.3 | Aug 28 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles… |
| CVE-2026-33607 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Aug 28 | An attacker that has valid credentials can use IMAP LIST command to consume CPU |
| CVE-2026-33606 | OD OX Dovecot Pro Open-Xchange GmbH | 4.8 | Aug 28 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example… |
| CVE-2026-33605 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Aug 28 | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating |
| CVE-2026-33604 | OD OX Dovecot Pro Open-Xchange GmbH | 5.9 | Aug 28 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the… |
| CVE-2026-33263 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Aug 28 | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues |
| CVE-2026-27852 | OD OX Dovecot CE Open-Xchange GmbH | 7.5 | Aug 28 | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage… |
| CVE-2026-42006 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | May 12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP |
| CVE-2026-40020 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | May 12 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no |
| CVE-2026-40016 | OD OX Dovecot Pro Open-Xchange GmbH | 6.5 | May 12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit |
| CVE-2026-33603 | OD OX Dovecot Pro Open-Xchange GmbH | 5.3 | May 12 | Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding |
| CVE-2026-27851 | OD OX Dovecot Pro Open-Xchange GmbH | 9.1 | May 12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped |
| CVE-2026-27860 | OD OX Dovecot Pro Open-Xchange GmbH | 5.3 | Mar 27 | If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication |
| CVE-2026-27859 | OD OX Dovecot Pro Open-Xchange GmbH | 5.3 | Mar 27 | A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU |
| CVE-2026-27858 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Mar 27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory |
| CVE-2026-27857 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Mar 27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage |
| CVE-2026-27856 | OD OX Dovecot Pro Open-Xchange GmbH | 5.9 | Mar 27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack |
| CVE-2026-27855 | OD OX Dovecot Pro Open-Xchange GmbH | 5.9 | Mar 27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions |
| CVE-2026-24031 | OD OX Dovecot Pro Open-Xchange GmbH | 8.2 | Mar 27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin |
| CVE-2026-0394 | OD OX Dovecot Pro Open-Xchange GmbH | 5.3 | Mar 27 | When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal… |
| CVE-2025-59032 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Mar 27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response |
| CVE-2025-59031 | OD OX Dovecot Pro Open-Xchange GmbH | 4.3 | Mar 27 | Dovecot has provided a script to use for attachment to text conversion |
| CVE-2025-59028 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Mar 27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail |
| CVE-2025-59026 | OA OX App Suite Open-Xchange GmbH | 5.4 | Nov 27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links |
| CVE-2025-59025 | OA OX App Suite Open-Xchange GmbH | 6.1 | Nov 27 | Malicious e-mail content can be used to execute script code |
| CVE-2025-30190 | OA OX App Suite Open-Xchange GmbH | 5.4 | Nov 27 | Malicious content at office documents can be used to inject script code when editing a document |
| CVE-2025-30186 | OA OX App Suite Open-Xchange GmbH | 5.4 | Nov 27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links |
| CVE-2025-30189 | OD OX Dovecot Pro Open-Xchange GmbH | 7.4 | Oct 31 | When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users |
| CVE-2025-30191 | OA OX App Suite Open-Xchange GmbH | 5.4 | Oct 31 | Malicious content from E-Mail can be used to perform a redressing attack |
| CVE-2025-30188 | OA OX App Suite Open-Xchange GmbH | 7.5 | Oct 31 | Malicious or unintentional API requests can be used to add significant amount of data to caches |
| CVE-2024-23185 | OD OX Dovecot Pro Open-Xchange GmbH | 7.5 | Sep 10 | Very large headers can cause resource exhaustion when parsing message |
| CVE-2024-23184 | OD OX Dovecot Pro Open-Xchange GmbH | 5.0 | Sep 10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive |
| CVE-2024-25584 | OD OX Dovecot Pro Open-Xchange GmbH | 5.3 | Sep 6 | Dovecot accepts dot LF DOT LF symbol as end of DATA command |