Is mailcow 2025-12a affected?

CVSS 9.3

6 known vulnerabilities affect 2025-12a (highest CVSS 9.3).

15 newer releases in its track, up to 2026-10. What changed up to 2026-10

Vulnerabilities affecting 2025-12a

9.3
CVE-2026-40872 Stored XSS in autodiscover logs email address field fixed in 2026-03b
8.9
CVE-2026-40873 Stored XSS in Quarantine attachment filenames fixed in 2026-03b
7.2
CVE-2026-40871 Second Order SQL Injection in quarantine category via API fixed in 2026-03b
7.0
CVE-2026-40875 Stored XSS in user login history real_rip fixed in 2026-03b
6.0
CVE-2026-40874 Missing authorization on Forwarding Hosts delete action fixed in 2026-03b
2.1
CVE-2026-40878 Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page fixed in 2026-03b