CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 2:40 PM ET)

What this means for you

This week: 3,356 CVEs published, 272 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,356; Show in the list
Critical, last 7 days: 272; Show in the list
Healthcare-tagged, last 7 days: 6; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product open_xchange:ox_dovecot_ce. Show all products

25 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-27852	High 7.5	An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is l… Assigned by OX	Aug 28, 2026
CVE-2026-33263	Medium 4.3	When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. Assigned by OX	Aug 28, 2026
CVE-2026-33604	Medium 5.9	An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that p… Assigned by OX	Aug 28, 2026
CVE-2026-33605	High 7.5	An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. Assigned by OX	Aug 28, 2026
CVE-2026-33606	Medium 4.8	Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Assigned by OX	Aug 28, 2026
CVE-2026-33607	Medium 4.3	An attacker that has valid credentials can use IMAP LIST command to consume CPU. Assigned by OX	Aug 28, 2026
CVE-2026-40013	Medium 4.3	An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. Assigned by OX	Aug 28, 2026
CVE-2026-40014	Medium 6.5	An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. Assigned by OX	Aug 28, 2026
CVE-2026-40015	Medium 4.3	An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. Assigned by OX	Aug 28, 2026
CVE-2026-40017	Medium 6.5	An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to t… Assigned by OX	Aug 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.