Skip to content
OpenAdvisories

Product · bulwarkmail

webmail

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-35390

    Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks

    Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting…

    bulwarkmail webmail