Email, DNS and file transfer: vulnerabilities and fixes

Postfix, Exim, Dovecot, BIND, Samba, FTP and managed file transfer tools. 226 CVEs tracked.

Email, DNS and file transfer has 226 tracked vulnerabilities, 50 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 199. Most recent: 2026-10-23. Highest priority: CVE-2015-3306 (score 100/100).

• CVE-2015-3306 CRITICAL 10.0 EXPLOITED MITIGATE MITIGATE ProFTPD Improper Access Control Vulnerability
• CVE-2015-5477 HIGH 7.5 EXPLOITED UPGRADE MITIGATE ISC BIND Data Processing Errors Vulnerability
• CVE-2025-6424 CRITICAL 9.8 UPGRADE A use-after-free in FontFaceSet resulted in a potentially exploitable crash
• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2023-2828 HIGH 7.5 UPGRADE MITIGATE Every `named` instance configured to run as a recursive resolver maintains a cache database holding the respon
• CVE-2023-29531 CRITICAL 9.8 UPGRADE UPGRADE An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption an
• CVE-2023-2911 HIGH 7.5 UPGRADE MITIGATE If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes
• CVE-2023-29542 CRITICAL 9.8 UPGRADE UPGRADE A newline in a filename could have been used to bypass the file extension security mechanisms that replace mal
• CVE-2023-34416 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12
• CVE-2026-16389 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions, integer overflow in the Libraries component in NSS
• CVE-2025-11708 CRITICAL 9.8 UPGRADE UPGRADE Use-after-free in MediaTrackGraphImpl::GetInstance()
• CVE-2025-11709 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process was able to trigger out of bounds reads and writes in a more privileged process usin
• CVE-2025-11710 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process using malicious IPC messages could have caused the privileged browser process to rev
• CVE-2026-5731 CRITICAL 9.8 DOWNGRADE DOWNGRADE Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.
• CVE-2026-5734 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 14
• CVE-2026-16353 CRITICAL 9.8 UPGRADE UPGRADE Invalid pointer in the DOM: Bindings (WebIDL) component
• CVE-2023-37202 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-37211 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12
• CVE-2026-16360 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152
• CVE-2026-16363 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript: WebAssembly component
• CVE-2026-16369 CRITICAL 9.8 UPGRADE UPGRADE Integer overflow in the JavaScript: WebAssembly component
• CVE-2026-16408 CRITICAL 9.8 UPGRADE Integer overflow in the Audio/Video: Playback component
• CVE-2026-5735 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1
• CVE-2026-16350 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the Audio/Video: cubeb component
• CVE-2026-16355 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16357 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the Graphics component
• CVE-2026-16367 CRITICAL 10.0 UPGRADE UPGRADE Sandbox escape due to invalid pointer in the Disability Access APIs component
• CVE-2023-25732 HIGH 8.8 UPGRADE UPGRADE When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded
• CVE-2023-25734 HIGH 8.1 UPGRADE UPGRADE After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a r
• CVE-2023-25735 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-25737 HIGH 8.8 UPGRADE UPGRADE An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behav
• CVE-2023-25739 HIGH 8.8 UPGRADE UPGRADE Module load requests that failed were not being checked as to whether or not they were cancelled causing a use
• CVE-2023-28162 HIGH 8.8 UPGRADE UPGRADE While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type
• CVE-2026-16351 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the DOM: Navigation component
• CVE-2026-16352 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16356 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16368 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2026-16377 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the PDF Viewer component
• CVE-2026-16382 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Service Workers component
• CVE-2026-16383 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Networking component
• CVE-2026-16388 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape in the DOM: Networking component
• CVE-2026-53791 CRITICAL 9.1 UPGRADE rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote att
• CVE-2026-94300 HIGH 8.1 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`"
• CVE-2023-2829 HIGH 7.5 UPGRADE MITIGATE A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSS
• CVE-2023-32214 HIGH 7.5 UPGRADE UPGRADE Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note:
• CVE-2026-16395 CRITICAL 9.8 UPGRADE Integer overflow in the Audio/Video component
• CVE-2026-16402 CRITICAL 9.8 UPGRADE UPGRADE Integer overflow in the Graphics: ImageLib component
• CVE-2023-0767 HIGH 8.8 UPGRADE UPGRADE An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes v
• CVE-2026-16361 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Thunderbird ESR 140.12
• CVE-2026-16410 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-59260 HIGH 8.8 OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegat
• CVE-2026-70461 HIGH 8.2 UPGRADE rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated
• CVE-2023-23605 HIGH 8.8 UPGRADE UPGRADE Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox
• CVE-2023-25746 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 102.7
• CVE-2023-28176 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 110 and Firefox ESR 102.8
• CVE-2023-29536 HIGH 8.8 UPGRADE UPGRADE An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled me
• CVE-2023-29539 HIGH 8.8 UPGRADE UPGRADE When handling the filename directive in the Content-Disposition header, the filename would be truncated if the
• CVE-2023-29550 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 111 and Firefox ESR 102.9
• CVE-2023-32207 HIGH 8.8 UPGRADE UPGRADE A missing delay in popup notifications could have made it possible for an attacker to trick a user into granti
• CVE-2023-32213 HIGH 8.8 UPGRADE UPGRADE When reading a file, an uninitialized value could have been used as read limit
• CVE-2023-37207 MEDIUM 6.5 UPGRADE UPGRADE A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external
• CVE-2025-10533 HIGH 8.8 UPGRADE UPGRADE Integer overflow in the SVG component
• CVE-2026-16392 CRITICAL 9.1 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16407 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Service Workers component
• CVE-2026-5732 HIGH 8.8 UPGRADE Incorrect boundary conditions, integer overflow in the Graphics: Text component
• CVE-2023-3600 HIGH 8.8 UPGRADE UPGRADE During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potenti
• CVE-2026-16390 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the Enterprise Policies component
• CVE-2026-70455 HIGH 7.5 UPGRADE rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust sys
• CVE-2026-11605 HIGH 7.5 The issue is a resource exhaustion vulnerability associated with DNSSEC validation
• CVE-2026-11622 HIGH 7.5 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer f
• CVE-2026-13204 HIGH 7.5 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RR
• CVE-2026-16349 CRITICAL 9.8 UPGRADE UPGRADE Same-origin policy bypass in the DOM: Navigation component
• CVE-2026-16358 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Graphics: WebRender component
• CVE-2026-16364 CRITICAL 9.1 UPGRADE UPGRADE Incorrect boundary conditions in the Audio/Video: Playback component
• CVE-2026-16370 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the DOM: Networking component
• CVE-2026-16375 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Networking: HTTP component
• CVE-2026-16380 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the Networking component
• CVE-2026-16387 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Networking component
• CVE-2026-16393 CRITICAL 9.1 UPGRADE UPGRADE Incorrect boundary conditions in the Graphics: WebGPU component
• CVE-2006-2073 MEDIUM 5.0 DOWNGRADE Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS m
• CVE-2026-16359 CRITICAL 9.1 UPGRADE UPGRADE Incorrect boundary conditions in the Audio/Video: GMP component
• CVE-2026-16372 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the DOM: Content Processes component
• CVE-2026-16394 CRITICAL 9.1 UPGRADE Mitigation bypass in the DOM: Security component
• CVE-2026-16406 CRITICAL 9.1 UPGRADE Mitigation bypass in the Networking component
• CVE-2026-19630 HIGH 7.5 In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional proces
• CVE-2026-96888 HIGH 7.5 A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with
• CVE-2026-97313 HIGH 7.5 A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query
• CVE-2023-28163 MEDIUM 6.5 UPGRADE UPGRADE When downloading files through the Save As dialog on Windows with suggested filenames containing environment v
• CVE-2026-11331 HIGH 7.5 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names
• CVE-2026-113386 HIGH 7.1 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection
• CVE-2026-53795 HIGH 8.1 UPGRADE rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside
• CVE-2023-25728 MEDIUM 6.5 UPGRADE UPGRADE The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's u
• CVE-2023-25751 MEDIUM 6.5 UPGRADE UPGRADE Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritt
• CVE-2023-29535 MEDIUM 6.5 UPGRADE UPGRADE Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced
• CVE-2023-29548 MEDIUM 6.5 UPGRADE UPGRADE A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result
• CVE-2023-37208 HIGH 7.8 UPGRADE UPGRADE When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code
• CVE-2026-10632 HIGH 8.7 A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-114720 HIGH 7.1 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
• CVE-2026-11721 HIGH 7.5 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels
• CVE-2026-50053 HIGH 8.7 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests
• CVE-2023-25738 MEDIUM 6.5 UPGRADE UPGRADE Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could
• CVE-2026-10697 HIGH 7.5 UPGRADE Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before
• CVE-2026-114716 HIGH 8.5 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
• CVE-2026-13321 HIGH 8.6 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the si
• CVE-2026-16354 HIGH 7.5 UPGRADE UPGRADE Information disclosure in the Graphics: ImageLib component
• CVE-2026-16376 HIGH 7.5 UPGRADE UPGRADE Denial-of-service in the Graphics: WebGPU component
• CVE-2026-16381 CRITICAL 9.1 UPGRADE UPGRADE Same-origin policy bypass in the Networking: DNS component
• CVE-2025-10528 HIGH 7.3 UPGRADE UPGRADE Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
• CVE-2025-10537 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
• CVE-2025-11714 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Th
• CVE-2025-11715 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
• CVE-2025-13014 HIGH 8.8 UPGRADE Use-after-free in the Audio/Video component
• CVE-2026-16374 HIGH 7.5 UPGRADE UPGRADE Information disclosure in the Framework component in DevTools
• CVE-2026-16378 HIGH 7.5 UPGRADE UPGRADE Other issue in the DOM: Copy & Paste and Drag & Drop component
• CVE-2026-16384 HIGH 7.5 UPGRADE UPGRADE Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16385 HIGH 7.5 UPGRADE UPGRADE Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16386 HIGH 7.5 UPGRADE UPGRADE Information disclosure due to uninitialized memory in the Graphics: WebGPU component
• CVE-2026-16391 HIGH 7.5 UPGRADE UPGRADE Information disclosure in the Storage: IndexedDB component
• CVE-2026-70459 MEDIUM 5.3 UPGRADE rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that al
• CVE-2026-93639 HIGH 8.7 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator wit
• CVE-2023-32206 MEDIUM 6.5 UPGRADE UPGRADE An out-of-bound read could have led to a crash in the RLBox Expat driver
• CVE-2023-32211 MEDIUM 6.5 UPGRADE UPGRADE A type checking bug would have led to invalid code being compiled
• CVE-2025-13020 HIGH 8.8 UPGRADE Use-after-free in the WebRTC: Audio/Video component
• CVE-2026-114730 HIGH 7.2 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery fil
• CVE-2026-14899 HIGH 7.5 UPGRADE The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was e
• CVE-2026-16362 HIGH 8.8 UPGRADE UPGRADE Use-after-free in the WebRTC: Audio/Video component
• CVE-2026-16365 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the DOM: Workers component
• CVE-2026-16371 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the DOM: Navigation component
• CVE-2026-16379 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the DOM: Content Processes component
• CVE-2026-16409 HIGH 7.5 UPGRADE UPGRADE Invalid pointer in the Security: PSM component
• CVE-2026-53786 MEDIUM 6.5 UPGRADE rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override m
• CVE-2026-54433 HIGH 7.2 UPGRADE In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a cr
• CVE-2026-70463 HIGH 8.1 UPGRADE rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing
• CVE-2023-1945 MEDIUM 6.5 UPGRADE UPGRADE Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially expl
• CVE-2023-23598 MEDIUM 6.5 UPGRADE UPGRADE Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs co
• CVE-2023-23599 MEDIUM 6.5 UPGRADE UPGRADE When copying a network request from the developer tools panel as a curl command the output was not being prope
• CVE-2023-25742 MEDIUM 6.5 UPGRADE UPGRADE When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to c
• CVE-2023-25752 MEDIUM 6.5 UPGRADE UPGRADE When accessing throttled streams, the count of available bytes needed to be checked in the calling function to
• CVE-2023-29545 MEDIUM 6.5 UPGRADE UPGRADE Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment
• CVE-2025-13016 HIGH 7.5 UPGRADE Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2026-114727 HIGH 8.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when
• CVE-2026-16366 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the DOM: Navigation component
• CVE-2026-16400 HIGH 7.5 UPGRADE UPGRADE Information disclosure in the DOM: Security component
• CVE-2026-16405 HIGH 7.5 UPGRADE Information disclosure in the Networking: WebSockets component
• CVE-2026-53994 HIGH 7.5 UPGRADE ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user
• CVE-2026-70457 MEDIUM 6.5 UPGRADE rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprint
• CVE-2026-15966 HIGH 7.5 UPGRADE Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. Thi
• CVE-2026-15967 HIGH 7.5 UPGRADE Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer
• CVE-2026-16396 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in WebExtensions
• CVE-2026-16401 HIGH 8.8 UPGRADE UPGRADE Privilege escalation in the Data Loss Prevention component

FAQ

How do I fix Email, DNS and file transfer vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Email, DNS and file transfer being exploited right now?

Yes: 2 Email, DNS and file transfer CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Email, DNS and file transfer CVE should I patch first?

CVE-2015-3306 currently ranks highest (100/100): ProFTPD Improper Access Control Vulnerability.

Software in this group

People search for: mail, exim, postfix, dns, bind, ftp, samba.

← Back to latest CVEs