bulwarkmail vulnerabilities
6 published CVEs name bulwarkmail among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-113728
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
bulwarkmail · webmail
High7.5 - CVE-2026-35391
Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery
bulwarkmail · webmail
High8.7 - CVE-2026-35390
Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
bulwarkmail · webmail
Medium5.3 - CVE-2026-35389
Bulwark Webmail S/MIME signature verification accepted self-signed certificates
bulwarkmail · webmail
High8.7 - CVE-2026-34834
Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
bulwarkmail · webmail
High8.7 - CVE-2026-34833
Bulwark Webmail: Information Exposure: password returned in /api/auth/session
bulwarkmail · webmail
High8.7