# cve.now: Open-xchange Gmbh

The newest entries naming Open-xchange Gmbh as an affected vendor (up to 200), of 77 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-73209](https://cve.now/CVE-2026-73209.md): An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. (CVSS 6.5)
- [CVE-2026-73208](https://cve.now/CVE-2026-73208.md): An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a s (CVSS 7.4)
- [CVE-2026-52687](https://cve.now/CVE-2026-52687.md): An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large (CVSS 6.5)
- [CVE-2026-52681](https://cve.now/CVE-2026-52681.md): Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly (CVSS 3.1)
- [CVE-2026-42395](https://cve.now/CVE-2026-42395.md): A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following log (CVSS 4.3)
- [CVE-2026-42393](https://cve.now/CVE-2026-42393.md): The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. (CVSS 3.1)
- [CVE-2026-42392](https://cve.now/CVE-2026-42392.md): An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the er (CVSS 4.3)
- [CVE-2026-42391](https://cve.now/CVE-2026-42391.md): An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP (CVSS 7.5)
- [CVE-2026-42008](https://cve.now/CVE-2026-42008.md): Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va (CVSS 4.3)
- [CVE-2026-42007](https://cve.now/CVE-2026-42007.md): An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing (CVSS 9.1)
- [CVE-2026-40205](https://cve.now/CVE-2026-40205.md): An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requi (CVSS 5.9)
- [CVE-2026-40204](https://cve.now/CVE-2026-40204.md): None None None No publicly available exploits are known. (CVSS 3.1)
- [CVE-2026-40203](https://cve.now/CVE-2026-40203.md): When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attac (CVSS 3.7)
- [CVE-2026-40019](https://cve.now/CVE-2026-40019.md): An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop c (CVSS 5.9)
- [CVE-2026-40018](https://cve.now/CVE-2026-40018.md): None None None No publicly available exploits are known. (CVSS 7.4)
- [CVE-2026-40017](https://cve.now/CVE-2026-40017.md): An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which make (CVSS 6.5)
- [CVE-2026-40015](https://cve.now/CVE-2026-40015.md): An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermit (CVSS 4.3)
- [CVE-2026-40014](https://cve.now/CVE-2026-40014.md): An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the s (CVSS 6.5)
- [CVE-2026-40013](https://cve.now/CVE-2026-40013.md): An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write (CVSS 4.3)
- [CVE-2026-33607](https://cve.now/CVE-2026-33607.md): An attacker that has valid credentials can use IMAP LIST command to consume CPU. (CVSS 4.3)
- [CVE-2026-33606](https://cve.now/CVE-2026-33606.md): Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync wit (CVSS 4.8)
- [CVE-2026-33605](https://cve.now/CVE-2026-33605.md): An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. (CVSS 7.5)
- [CVE-2026-33604](https://cve.now/CVE-2026-33604.md): An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i (CVSS 5.9)
- [CVE-2026-33263](https://cve.now/CVE-2026-33263.md): When mail\_max\_userip\_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha (CVSS 4.3)
- [CVE-2026-27852](https://cve.now/CVE-2026-27852.md): An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters (CVSS 7.5)
- [CVE-2026-42006](https://cve.now/CVE-2026-42006.md): An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. (CVSS 4.3)
- [CVE-2026-40020](https://cve.now/CVE-2026-40020.md): Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap\_acl\_allow\_anyone=no. (CVSS 3.1)
- [CVE-2026-40016](https://cve.now/CVE-2026-40016.md): Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 (CVSS 5.3)
- [CVE-2026-33603](https://cve.now/CVE-2026-33603.md): Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. (CVSS 6.8)
- [CVE-2026-27851](https://cve.now/CVE-2026-27851.md): When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli (CVSS 7.4)
- [CVE-2026-27860](https://cve.now/CVE-2026-27860.md): If auth\_username\_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. (CVSS 3.7)
- [CVE-2026-27859](https://cve.now/CVE-2026-27859.md): A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. (CVSS 5.3)
- [CVE-2026-27858](https://cve.now/CVE-2026-27858.md): Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. (CVSS 7.5)
- [CVE-2026-27857](https://cve.now/CVE-2026-27857.md): Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. (CVSS 4.3)
- [CVE-2026-27856](https://cve.now/CVE-2026-27856.md): Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. (CVSS 7.4)
- [CVE-2026-27855](https://cve.now/CVE-2026-27855.md): Dovecot OTP authentication is vulnerable to replay attack under specific conditions. (CVSS 6.8)
- [CVE-2026-24031](https://cve.now/CVE-2026-24031.md): Dovecot SQL based authentication can be bypassed when auth\_username\_chars is cleared by admin. (CVSS 7.7)
- [CVE-2026-0394](https://cve.now/CVE-2026-0394.md): When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added (CVSS 5.3)
- [CVE-2025-59032](https://cve.now/CVE-2025-59032.md): ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. (CVSS 7.5)
- [CVE-2025-59031](https://cve.now/CVE-2025-59031.md): Dovecot has provided a script to use for attachment to text conversion. (CVSS 4.3)
- [CVE-2025-59028](https://cve.now/CVE-2025-59028.md): When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai (CVSS 5.3)
- [CVE-2025-59026](https://cve.now/CVE-2025-59026.md): Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. (CVSS 5.4)
- [CVE-2025-59025](https://cve.now/CVE-2025-59025.md): Malicious e-mail content can be used to execute script code. (CVSS 6.1)
- [CVE-2025-30190](https://cve.now/CVE-2025-30190.md): Malicious content at office documents can be used to inject script code when editing a document. (CVSS 5.4)
- [CVE-2025-30186](https://cve.now/CVE-2025-30186.md): Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. (CVSS 5.4)
- [CVE-2025-30189](https://cve.now/CVE-2025-30189.md): When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be us (CVSS 7.4)
- [CVE-2025-30191](https://cve.now/CVE-2025-30191.md): Malicious content from E-Mail can be used to perform a redressing attack. (CVSS 5.4)
- [CVE-2025-30188](https://cve.now/CVE-2025-30188.md): Malicious or unintentional API requests can be used to add significant amount of data to caches. (CVSS 7.5)
- [CVE-2024-23185](https://cve.now/CVE-2024-23185.md): Very large headers can cause resource exhaustion when parsing message. (CVSS 7.5)
- [CVE-2024-23184](https://cve.now/CVE-2024-23184.md): Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. (CVSS 5.0)
- [CVE-2024-25584](https://cve.now/CVE-2024-25584.md): Dovecot accepts dot LF DOT LF symbol as end of DATA command. (CVSS 5.3)
- [CVE-2024-25582](https://cve.now/CVE-2024-25582.md): Module savepoints could be abused to inject references to malicious code delivered through the same domain. (CVSS 5.4)
- [CVE-2024-23193](https://cve.now/CVE-2024-23193.md): E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. (CVSS 5.3)
- [CVE-2024-23188](https://cve.now/CVE-2024-23188.md): Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. (CVSS 6.5)
- [CVE-2024-23187](https://cve.now/CVE-2024-23187.md): Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. (CVSS 6.5)
- [CVE-2024-23186](https://cve.now/CVE-2024-23186.md): E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. (CVSS 6.5)
- [CVE-2024-23192](https://cve.now/CVE-2024-23192.md): RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised (CVSS 6.1)
- [CVE-2024-23191](https://cve.now/CVE-2024-23191.md): Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. (CVSS 5.4)
- [CVE-2024-23190](https://cve.now/CVE-2024-23190.md): Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. (CVSS 5.4)
- [CVE-2024-23189](https://cve.now/CVE-2024-23189.md): Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. (CVSS 5.4)
- [CVE-2023-41708](https://cve.now/CVE-2023-41708.md): References to the "app loader" functionality could contain redirects to unexpected locations. (CVSS 5.4)
- [CVE-2023-41707](https://cve.now/CVE-2023-41707.md): Processing of user-defined mail search expressions is not limited. (CVSS 6.5)
- [CVE-2023-41706](https://cve.now/CVE-2023-41706.md): Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. (CVSS 6.5)
- [CVE-2023-41705](https://cve.now/CVE-2023-41705.md): Processing of user-defined DAV user-agent strings is not limited. (CVSS 6.5)
- [CVE-2023-41704](https://cve.now/CVE-2023-41704.md): Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. (CVSS 7.1)
- [CVE-2023-41703](https://cve.now/CVE-2023-41703.md): User ID references at mentions in document comments were not correctly sanitized. (CVSS 6.1)
- [CVE-2023-41710](https://cve.now/CVE-2023-41710.md): User-defined script code could be stored for a upsell related shop URL. (CVSS 5.4)
- [CVE-2023-29052](https://cve.now/CVE-2023-29052.md): Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. (CVSS 5.4)
- [CVE-2023-29051](https://cve.now/CVE-2023-29051.md): User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. (CVSS 8.1)
- [CVE-2023-29050](https://cve.now/CVE-2023-29050.md): The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside (CVSS 7.6)
- [CVE-2023-29049](https://cve.now/CVE-2023-29049.md): The "upsell" widget at the portal page could be abused to inject arbitrary script code. (CVSS 5.4)
- [CVE-2023-29048](https://cve.now/CVE-2023-29048.md): A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged run (CVSS 8.8)
- [CVE-2016-7074](https://cve.now/CVE-2016-7074.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in- (CVSS 5.3)
- [CVE-2016-7073](https://cve.now/CVE-2016-7073.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in- (CVSS 5.3)
- [CVE-2016-7069](https://cve.now/CVE-2016-7069.md): An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. (CVSS 5.9)
- [CVE-2016-7068](https://cve.now/CVE-2016-7068.md): An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticate (CVSS 5.3)
- [CVE-2016-7072](https://cve.now/CVE-2016-7072.md): An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a deni (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/open-xchange
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.