# cve.now: Seppmail

The newest entries naming Seppmail as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114421](https://cve.now/CVE-2026-114421.md): Empty initial password permits GINA account takeover (CVSS 8.3)
- [CVE-2026-114420](https://cve.now/CVE-2026-114420.md): LDAP wildcard injection exposes GINA recipient accounts (CVSS 6.9)
- [CVE-2026-114426](https://cve.now/CVE-2026-114426.md): Pre-authentication upload parsing permits resource exhaustion (CVSS 8.7)
- [CVE-2026-114425](https://cve.now/CVE-2026-114425.md): Forged LFT metadata permits arbitrary file read and deletion (CVSS 9.2)
- [CVE-2026-114424](https://cve.now/CVE-2026-114424.md): Code execution through double evaluation in address replacement rules (CVSS 9.2)
- [CVE-2026-84830](https://cve.now/CVE-2026-84830.md): OS command injection in privileged configuration handling (CVSS 8.6)
- [CVE-2026-84832](https://cve.now/CVE-2026-84832.md): Unsafe deserialization in the REST interface (CVSS 8.6)
- [CVE-2026-84831](https://cve.now/CVE-2026-84831.md): Mandatory MFA bypass before enrollment (CVSS 7.7)
- [CVE-2026-9592](https://cve.now/CVE-2026-9592.md): Sensitive Information Disclosure in HTTP header (CVSS 7.5)
- [CVE-2026-8811](https://cve.now/CVE-2026-8811.md): Path traversal in PDF generation module (CVSS 7.1)
- [CVE-2026-44126](https://cve.now/CVE-2026-44126.md): Insecure deserialization (CVSS 9.2)
- [CVE-2026-44125](https://cve.now/CVE-2026-44125.md): Missing Authorization in GINAv2 (CVSS 9.3)
- [CVE-2026-44129](https://cve.now/CVE-2026-44129.md): Server-side template injection (CVSS 8.3)
- [CVE-2026-44128](https://cve.now/CVE-2026-44128.md): Unauthenticated Remote Code Execution (CVSS 9.3)
- [CVE-2026-44127](https://cve.now/CVE-2026-44127.md): Local File Inclusion (LFI) and Arbitrary File Deletion (CVSS 8.8)
- [CVE-2026-7864](https://cve.now/CVE-2026-7864.md): Exposure of Sensitive Information to an Unauthorized Actor (CVSS 6.9)
- [CVE-2026-29136](https://cve.now/CVE-2026-29136.md): CA Notification HTML Injection (CVSS 5.3)
- [CVE-2026-29139](https://cve.now/CVE-2026-29139.md): GINA State Confusion Account Takeover (CVSS 7.8)
- [CVE-2026-29144](https://cve.now/CVE-2026-29144.md): Unicode Subject Tags (CVSS 7.8)
- [CVE-2026-29143](https://cve.now/CVE-2026-29143.md): S/MIME Decryption Impersonation (CVSS 7.8)
- [CVE-2026-29138](https://cve.now/CVE-2026-29138.md): PGP Decryption Sender LDAP Injection (CVSS 6.3)
- [CVE-2026-29131](https://cve.now/CVE-2026-29131.md): PGP Decryption Recipient LDAP Injection (CVSS 4.9)
- [CVE-2026-29142](https://cve.now/CVE-2026-29142.md): Plaintext secure-mail.html (CVSS 6.3)
- [CVE-2026-29137](https://cve.now/CVE-2026-29137.md): Long Subject Untagging (CVSS 5.3)
- [CVE-2026-29141](https://cve.now/CVE-2026-29141.md): Bounded Subject Tag Sanitization (CVSS 7.7)
- [CVE-2026-29135](https://cve.now/CVE-2026-29135.md): Webmail Password Tag Sanitization Bypass (CVSS 5.3)
- [CVE-2026-29134](https://cve.now/CVE-2026-29134.md): GINA Domain Switch (CVSS 5.3)
- [CVE-2026-29140](https://cve.now/CVE-2026-29140.md): S/MIME Signature Additional Certificate (CVSS 7.7)
- [CVE-2026-29133](https://cve.now/CVE-2026-29133.md): UID Regex Bypass (CVSS 5.3)
- [CVE-2026-29132](https://cve.now/CVE-2026-29132.md): ESWmail-Verify Bypass (CVSS 6.3)
- [CVE-2026-2743](https://cve.now/CVE-2026-2743.md): SEPPmail User Web Interface Arbitrary File Write to RCE (CVSS 10.0)
- [CVE-2026-27441](https://cve.now/CVE-2026-27441.md): PDF Password CMDi (CVSS 9.5)
- [CVE-2026-2748](https://cve.now/CVE-2026-2748.md): S/MIME Certificate Subject Whitespace (CVSS 7.8)
- [CVE-2026-27442](https://cve.now/CVE-2026-27442.md): zip\_attachments Path Traversal (CVSS 9.3)
- [CVE-2026-27445](https://cve.now/CVE-2026-27445.md): PGP Signature Reflection (CVSS 6.9)
- [CVE-2026-27444](https://cve.now/CVE-2026-27444.md): Header Email Address Parsing (CVSS 7.8)
- [CVE-2026-2747](https://cve.now/CVE-2026-2747.md): PGP Mixed Plaintext and Encrypted Content (CVSS 6.9)
- [CVE-2026-27443](https://cve.now/CVE-2026-27443.md): S/MIME Decryption Tag Sanitization Bypass (CVSS 8.2)
- [CVE-2026-2746](https://cve.now/CVE-2026-2746.md): Missing PGP Signature Tag (CVSS 6.9)
- [CVE-2022-41871](https://cve.now/CVE-2022-41871.md): SEPPmail through 12.1.17 allows command injection within the Admin Portal. (CVSS 6.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/seppmail
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.