Vendor
SEPPmail
40 known vulnerabilities.
SEPPmail at a glance
- Last 12 months
- 39
- Critical · all time
- 8
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 5 | 2 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 3 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 6 | 3 |
| Apr 2026 | 14 | 0 |
| Mar 2026 | 9 | 3 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 9.1
OpenSSL: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.
first Jun 9, 2026 -
Medium max 7.7
OpenSSH: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrun…
first Jul 6, 2026 -
High max 9.2WID-SEC-2026-4349 5 CVEs
SEPPmail Secure E-Mail Gateway: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren…
-
Medium max 7.5
OpenSSH: Mehrere Schwachstellen
Ein entfernter Angreifer kann mehrere Schwachstellen in OpenSSH ausnutzen, um Code auszuführen, Privilegien zu erhöhen, Sicherheitsmechanismen zu umgehen oder nicht näher spezifizierte Auswirkungen zu erzielen.
first Apr 6, 2026 -
High max 8.6WID-SEC-2026-3178 3 CVEs
SEPPmail Secure E-Mail Gateway: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway ausnutzen, um beliebige Kommandos auszuführen und um Sicherheitsmechanismen zu umgehen.
40 results · Feed
-
High 8.3
Empty initial password permits GINA account takeover
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set …
-
Medium 6.9
LDAP wildcard injection exposes GINA recipient accounts
SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.
-
High 8.7
Pre-authentication upload parsing permits resource exhaustion
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage wit…
-
Critical 9.2
Forged LFT metadata permits arbitrary file read and deletion
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular fi…
-
Critical 9.2
Code execution through double evaluation in address replacement rules
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context w…
-
High 8.6
OS command injection in privileged configuration handling
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
-
High 8.6
Unsafe deserialization in the REST interface
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges.
-
High 7.7
Mandatory MFA bypass before enrollment
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality wit…
-
High 7.5
Sensitive Information Disclosure in HTTP header
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
-
High 7.1
Path traversal in PDF generation module
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.
-
Critical 9.2
Insecure deserialization
SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthenticated remote attackers to execute code via a crafted serialized object.
-
Critical 9.3
Missing Authorization in GINAv2
SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.
-
High 8.3
Server-side template injection
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and po…
-
Critical 9.3
Unauthenticated Remote Code Execution
SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint passes attacker-controlled input from a parameter to Perl's eval.
-
High 8.8CVE-2026-44127 EPSS 15%
Local File Inclusion (LFI) and Arbitrary File Deletion
SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment/preview that allows remote attackers to read arbitrary local files and trigger deletion of files in…
-
Medium 6.9CVE-2026-7864 EPSS 16%
Exposure of Sensitive Information to an Unauthorized Actor
SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.
-
Medium 5.3
CA Notification HTML Injection
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates.
-
High 7.8
GINA State Confusion Account Takeover
SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.
-
High 7.8
Unicode Subject Tags
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters.
-
High 7.8
S/MIME Decryption Impersonation
SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.
-
Medium 6.3
PGP Decryption Sender LDAP Injection
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.
-
Medium 4.9
PGP Decryption Recipient LDAP Injection
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users.
-
Medium 6.3
Plaintext secure-mail.html
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email.
-
Medium 5.3
Long Subject Untagging
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to hide security tags from users by crafting a long subject.
-
High 7.7
Bounded Subject Tag Sanitization
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK].
-
Medium 5.3
Webmail Password Tag Sanitization Bypass
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization.
-
Medium 5.3
GINA Domain Switch
SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions.
-
High 7.7
S/MIME Signature Additional Certificate
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME signatures.
-
Medium 5.3
UID Regex Bypass
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address.
-
Medium 6.3
ESWmail-Verify Bypass
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protected emails.
-
Critical 10.0
SEPPmail User Web Interface Arbitrary File Write to RCE
Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT). This issue affects SeppMail: 15.0.2.1 and before
-
Critical 9.5
PDF Password CMDi
SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.
-
High 7.8
S/MIME Certificate Subject Whitespace
SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signature spoofing.
-
Critical 9.3
zip_attachments Path Traversal
The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway.
-
Medium 6.9
PGP Signature Reflection
SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofing.
-
High 7.8
Header Email Address Parsing
SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it.
-
Medium 6.9
PGP Mixed Plaintext and Encrypted Content
SEPPmail Secure Email Gateway before version 15.0.1 decrypts inline PGP messages without isolating them from surrounding unencrypted content, allowing exposure of sensitive information to an unauthorized actor.
-
High 8.2
S/MIME Decryption Tag Sanitization Bypass
SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers.
-
Medium 6.9
Missing PGP Signature Tag
SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, leaving users unable to detect forged emails.
-
Medium 6.0
SEPPmail through 12.1.17 allows command injection within the Admin Portal. An authenticated attacker is able to execute…