mailcow

Mail · products/mailcow.yaml · RSS

Latest 2026-10 Oct 21, 2026

Recent releases

2026-10 Oct 21, 2026 Release notes ↗ 3security1feature

security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub

security[SOGo] Update to 5.12.12

security[Nginx] Update to 1.30.6

2026-09 Sep 21, 2026 → 2026-10 Release notes ↗ 2feature5fix

2026-09a Oct 6, 2026 → 2026-10 Release notes ↗ 1fix

2026-07 Jul 13, 2026 → 2026-10 Release notes ↗ 1fix

2026-07b Aug 18, 2026 → 2026-10 Release notes ↗

2026-07a Jul 30, 2026 → 2026-10 Release notes ↗ 4security9fix

security[Rspamd] update to 4.1.4

securityFix nginx CVE-2026-42533

securityUpdate actions/stale action to v11

2026-05 May 12, 2026 → 2026-10 Release notes ↗

2026-05c May 26, 2026 → 2026-10 Release notes ↗ 1security

securityfix unbound CVE-2026-33278

2026-05b May 21, 2026 → 2026-10 Release notes ↗ 1feature

2026-05a May 13, 2026 → 2026-10 Release notes ↗

2026-03 Mar 10, 2026 → 2026-10 Release notes ↗ 7feature8fix

2026-03b Mar 31, 2026 → 2026-10 Release notes ↗ 6security

securityFixes CVE-2026-40872: Stored XSS in autodiscover logs email address field

securityFixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames

securityFixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API

2026-03a Mar 13, 2026 → 2026-10 Release notes ↗ 1fix

2026-01 Jan 29, 2026 → 2026-10 Release notes ↗ 8feature3fix

2025-12 Dec 9, 2025 → 2026-10 Release notes ↗ 2feature1security1fix

securityRemove deprecated 'X-XSS-Protection' header

Security advisories

7.0 CVE-2026-40875 Stored XSS in user login history real_rip

6.0 CVE-2026-40874 Missing authorization on Forwarding Hosts delete action

8.9 CVE-2026-40873 Stored XSS in Quarantine attachment filenames

9.3 CVE-2026-40872 Stored XSS in autodiscover logs email address field

7.2 CVE-2026-40871 Second Order SQL Injection in quarantine category via API

2.1 CVE-2026-40878 Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page

9.1 CVE-2025-53909 SSTI in Quota and Quarantine Notification Template

7.1 CVE-2025-25198 Password reset poisoning

7.0 CVE-2024-56529 Session Fixation on mailcow web panel

6.6 CVE-2024-41958 Two-Factor Authentication (2FA) Bypass Vulnerability

7.6 CVE-2024-41959 XSS Vulnerability via API Logs

3.8 CVE-2024-41960 XSS Vulnerability via Relay Hosts Configuration

6.7 CVE-2024-30270 Path Traversal and Arbitrary Code Execution Vulnerability

6.8 CVE-2024-31204 XSS Vulnerability via Exception Handler

8.8 CVE-2024-24760 Docker Container Exposure to Local Network

4.7 CVE-2024-23824 Pixel flood attack leads to Denial of Service in admin page

8.3 CVE-2023-49077 XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

8.8 CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

high CVE-2023-26490 Shell command injection via xoauth2 authentication in imapsync

medium CVE-2022-39258 Possible Phishing attacks through Swagger UI

Recent releases

Security advisories

Sources