Alinto SOGo vulnerabilities
14 published CVEs name Alinto SOGo among the affected products.
- 14Published CVEs14 of them scored
- 12Last 12 monthspublished in the last year
- 2Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-127145
SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
Alinto · sogo
Medium5.3 - CVE-2026-127141
SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait
Alinto · sogo
High7.1 - CVE-2026-127135
SOGo before 5.12.13 Sieve Script Injection via Notification Address
Alinto · sogo
Medium5.3 - CVE-2026-127131
SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification
Alinto · sogo
Critical9.1 - CVE-2026-127121
SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView
Alinto · sogo
High7.1 - CVE-2026-127111
SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force
Alinto · sogo
Critical9.1 - CVE-2026-93453
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
Alinto · SOGo
High8.7 - CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in…
Alinto · SOGo
High7.1 - CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
Alinto · SOGo
High7.1 - CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
Alinto · SOGo
Low2.0