# mailcow-dockerized.

Every CVE that names mailcow-dockerized among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped](https://agentprime.io/advisories/CVE-2026-7460.md)
  `CVE-2026-7460` · CVE record: mailcow mailcow-dockerized · CVSS 7.4 High · Not analysed yet · Published 20 May 2026 · Tags: Cross-site scripting (XSS)
- [mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping](https://agentprime.io/advisories/CVE-2026-40878.md)
  `CVE-2026-40878` · CVE record: mailcow mailcow-dockerized · CVSS 2.1 Low · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS)
- [mailcow: dockerized vulnerable to stored XSS in user login history real_rip](https://agentprime.io/advisories/CVE-2026-40875.md)
  `CVE-2026-40875` · CVE record: mailcow mailcow-dockerized · CVSS 7.0 High · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS)
- [mailcow: dockerized missing authorization on Forwarding Hosts delete action](https://agentprime.io/advisories/CVE-2026-40874.md)
  `CVE-2026-40874` · CVE record: mailcow mailcow-dockerized · CVSS 6.0 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control
- [mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames](https://agentprime.io/advisories/CVE-2026-40873.md)
  `CVE-2026-40873` · CVE record: mailcow mailcow-dockerized · CVSS 8.9 High · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS)
- [mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field](https://agentprime.io/advisories/CVE-2026-40872.md)
  `CVE-2026-40872` · CVE record: mailcow mailcow-dockerized · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS)
- [mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API](https://agentprime.io/advisories/CVE-2026-40871.md)
  `CVE-2026-40871` · CVE record: mailcow mailcow-dockerized · CVSS 7.2 High · Not analysed yet · Published 21 Apr 2026 · Tags: SQL injection, CWE-20, CWE-116
- [mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template](https://agentprime.io/advisories/CVE-2025-53909.md)
  `CVE-2025-53909` · CVE record: mailcow mailcow-dockerized · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2025 · Tags: Code injection
- [mailcow: dockerized vulnerable to password reset poisoning](https://agentprime.io/advisories/CVE-2025-25198.md)
  `CVE-2025-25198` · CVE record: mailcow mailcow-dockerized · CVSS 7.1 High · Not analysed yet · Published 12 Feb 2025 · Tags: Open redirect
- [Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized](https://agentprime.io/advisories/CVE-2024-41960.md)
  `CVE-2024-41960` · CVE record: mailcow mailcow-dockerized · CVSS 3.8 Low · Not analysed yet · Published 5 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) via API Logs in mailcow: dockerized](https://agentprime.io/advisories/CVE-2024-41959.md)
  `CVE-2024-41959` · CVE record: mailcow mailcow-dockerized · CVSS 7.6 High · Not analysed yet · Published 5 Aug 2024 · Tags: Cross-site scripting (XSS)
- [Two-Factor Authentication (2FA) Bypass in mailcow: dockerized](https://agentprime.io/advisories/CVE-2024-41958.md)
  `CVE-2024-41958` · CVE record: mailcow mailcow-dockerized · CVSS 6.6 Medium · Not analysed yet · Published 5 Aug 2024 · Tags: CWE-697
- [mailcow Cross-site Scripting Vulnerability via Exception Handler](https://agentprime.io/advisories/CVE-2024-31204.md)
  `CVE-2024-31204` · CVE record: mailcow mailcow-dockerized · CVSS 6.1 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Cross-site scripting (XSS)
- [mailcow Path Traversal and Arbitrary Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-30270.md)
  `CVE-2024-30270` · CVE record: mailcow mailcow-dockerized · CVSS 6.2 Medium · EPSS 0.27 · Not analysed yet · Published 4 Apr 2024 · Tags: Path traversal
- [Mailcow Docker Container Exposure to Local Network](https://agentprime.io/advisories/CVE-2024-24760.md)
  `CVE-2024-24760` · CVE record: mailcow mailcow-dockerized · CVSS 8.8 High · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-610
- [mailcow ipixel flood attack leads to Denial of Service in admin page](https://agentprime.io/advisories/CVE-2024-23824.md)
  `CVE-2024-23824` · CVE record: mailcow mailcow-dockerized · CVSS 4.7 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: Denial of service
- [mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation](https://agentprime.io/advisories/CVE-2023-49077.md)
  `CVE-2023-49077` · CVE record: mailcow mailcow-dockerized · CVSS 8.3 High · Not analysed yet · Published 30 Nov 2023 · Tags: Cross-site scripting (XSS)
- [Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords](https://agentprime.io/advisories/CVE-2023-34108.md)
  `CVE-2023-34108` · CVE record: mailcow mailcow-dockerized · CVSS 8.8 High · Not analysed yet · Published 7 Jun 2023 · Tags: Command injection
- [mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync](https://agentprime.io/advisories/CVE-2023-26490.md)
  `CVE-2023-26490` · CVE record: mailcow mailcow-dockerized · CVSS 7.3 High · Not analysed yet · Published 3 Mar 2023 · Tags: Command injection
- [mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI](https://agentprime.io/advisories/CVE-2022-39258.md)
  `CVE-2022-39258` · CVE record: mailcow mailcow-dockerized · CVSS 8.1 High · Not analysed yet · Published 27 Sept 2022 · Tags: Information disclosure, CWE-451
- [OS Command Injection in mailcow](https://agentprime.io/advisories/CVE-2022-31138.md)
  `CVE-2022-31138` · CVE record: mailcow mailcow-dockerized · CVSS 8.8 High · Not analysed yet · Published 11 Jul 2022 · Tags: Command injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mailcow-dockerized>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mailcow-dockerized/>. Everything for agents: <https://agentprime.io/llms.txt>.