Known vulnerabilities in OX Dovecot Pro

Vendor: Dovecot
Software: OX Dovecot Pro
Software CPE: cpe:2.3:a:dovecot:ox_dovecot_pro:*:*:*:*:*:*:*:*
Website: https://www.dovecot.org/
Total vulnerabilities: 15
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OX Dovecot Pro OX Dovecot Pro is affected by 15 known vulnerabilities: 1 high, 10 medium, 4 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131865 - Improper Handling of Extra Parameters
CVE-2026-27851		 CWE-235 Medium
No
No
 3.1.5 19.05.2026 SB2026051937
SB2026051938
SB2026051939
and 2 more
#VU131866 - Resource exhaustion
CVE-2026-40016		 CWE-400 Low
No
No
 3.1.5 19.05.2026 SB2026051937
SB2026053112
SB2026060308
and 1 more
#VU131867 - Improper Control of Resource Identifiers ('Resource Injection')
CVE-2026-33603		 CWE-99 Medium
No
No
 3.1.5 19.05.2026 SB2026051937
SB2026051938
SB2026051939
and 4 more
#VU131868 - Improper Access Control
CVE-2026-40020		 CWE-284 Low
No
No
 3.1.5 19.05.2026 SB2026051937
SB2026051938
SB2026051939
and 4 more
#VU131869 - Resource exhaustion
CVE-2026-42006		 CWE-400 Low
No
No
 3.1.5 19.05.2026 SB2026051937
SB2026051938
SB2026051939
and 14 more
#VU124721 - Improper input validation
CVE-2025-59028		 CWE-20 Medium
No
No
 3.1.2 01.04.2026 SB2026040127
SB2026040132
SB2026042920
#VU124722 - Improper input validation
CVE-2025-59032		 CWE-20 Medium
No
No
 3.1.3 01.04.2026 SB2026040128
SB2026040132
SB2026041137
and 14 more
#VU124723 - Exposure of sensitive information to an unauthorized actor
CVE-2025-59031		 CWE-200 Low
No
No
 2.3.22.1, 3.1.3 01.04.2026 SB2026040130
SB2026040132
SB2026041137
and 2 more
#VU124724 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-0394		 CWE-22 Medium
No
No
 3.1.0 01.04.2026 SB2026040126
SB2026040132
SB2026041137
and 1 more
#VU124725 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2026-27860		 CWE-90 Medium
No
No
 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026042920
#VU124726 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-24031		 CWE-89 Medium
No
No
 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026042920
#VU124727 - Resource exhaustion
CVE-2026-27859		 CWE-400 Medium
No
No
 3.0.5, 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026041137
and 2 more
#VU124728 - Resource exhaustion
CVE-2026-27857		 CWE-400 Medium
No
No
 2.3.22.1, 3.0.5, 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026041137
and 20 more
#VU124729 - Resource exhaustion
CVE-2026-27858		 CWE-400 Medium
No
No
 2.3.22.1, 3.0.5, 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026041137
and 16 more
#VU124730 - Improper Authentication
CVE-2026-27856		 CWE-287 High
No
No
 2.3.22.1, 3.0.5, 3.1.4 01.04.2026 SB2026040129
SB2026040132
SB2026041137
and 3 more