CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 10:10 PM ET)

What this means for you

This week: 3,085 CVEs published, 232 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,085; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product open_xchange:ox_dovecot_pro. Show all products

41 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-73209	Medium 6.5	An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. Assigned by OX	Aug 28, 2026
CVE-2026-73208	High 7.4	An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and che… Assigned by OX	Aug 28, 2026
CVE-2026-52687	Medium 6.5	An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. Assigned by OX	Aug 28, 2026
CVE-2026-52681	Low 3.1	Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Assigned by OX	Aug 28, 2026
CVE-2026-42395	Medium 4.3	A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. Assigned by OX	Aug 28, 2026
CVE-2026-42393	Low 3.1	The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. Assigned by OX	Aug 28, 2026
CVE-2026-42392	Medium 4.3	An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Assigned by OX	Aug 28, 2026
CVE-2026-42391	High 7.5	An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. Assigned by OX	Aug 28, 2026
CVE-2026-42008	Medium 4.3	Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authen… Assigned by OX	Aug 28, 2026
CVE-2026-42007	Critical 9.1	An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buff… Assigned by OX	Aug 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.