# cve.now: SmarterTools

The newest entries naming SmarterTools as an affected vendor (up to 200), of 15 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104084](https://cve.now/CVE-2026-104084.md): SmarterMail \< Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token (CVSS 8.7)
- [CVE-2026-104083](https://cve.now/CVE-2026-104083.md): SmarterMail \< Build 9777 Stored Mutation XSS via MathML Foreign Content (CVSS 5.3)
- [CVE-2026-104082](https://cve.now/CVE-2026-104082.md): SmarterMail \< Build 9777 SysAdmin Remote Code Execution via Volume Mount (CVSS 8.6)
- [CVE-2026-7807](https://cve.now/CVE-2026-7807.md): SmarterTools SmarterMail \< Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API (CVSS 8.7)
- [CVE-2026-40514](https://cve.now/CVE-2026-40514.md): SmarterTools SmarterMail \< Build 9610 Cryptographic Weakness via Weak RNG (CVSS 8.2)
- [CVE-2026-26930](https://cve.now/CVE-2026-26930.md): SmarterTools SmarterMail before 9526 allows XSS via MAPI requests. (CVSS 7.2)
- [CVE-2026-25067](https://cve.now/CVE-2026-25067.md): SmarterTools SmarterMail \< Build 9518 Unauthenticated background-of-the-day Path Coercion (CVSS 6.9)
- [CVE-2026-24423](https://cve.now/CVE-2026-24423.md): SmarterTools SmarterMail \< Build 9511 Unauthenticated RCE via ConnectToHub API (CVSS 9.3, KEV)
- [CVE-2026-23760](https://cve.now/CVE-2026-23760.md): SmarterTools SmarterMail \< Build 9511 Authentication Bypass via Password Reset API (CVSS 9.3, KEV)
- [CVE-2020-36926](https://cve.now/CVE-2020-36926.md): SmarterTools SmarterTrack 7922 -Information Disclosure (CVSS 6.9)
- [CVE-2025-52691](https://cve.now/CVE-2025-52691.md): Upload Arbitrary Files (CVSS 10.0, KEV)
- [CVE-2022-24387](https://cve.now/CVE-2022-24387.md): File upload and overwrite to app\_data/Config in SmarterTrack v100.0.8019.14010 (CVSS 9.1)
- [CVE-2022-24386](https://cve.now/CVE-2022-24386.md): Stored XSS in SmarterTrack v100.0.8019.14010 (CVSS 8.8)
- [CVE-2022-24385](https://cve.now/CVE-2022-24385.md): Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 (CVSS 6.5)
- [CVE-2022-24384](https://cve.now/CVE-2022-24384.md): Reflective XSS on SmarterTrack v100.0.8019.14010 (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/smartertools
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.