https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-53909.htmlhttps://patchthecve.com/cve/CVE-2025-53909.htmlWed, 17 Jun 2026 09:39:06 +0000CRITICAL 9.1: mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows temhttps://patchthecve.com/cve/CVE-2025-25198.htmlhttps://patchthecve.com/cve/CVE-2025-25198.htmlWed, 17 Jun 2026 09:00:28 +0000HIGH 7.1: mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This https://patchthecve.com/cve/CVE-2024-41960.htmlhttps://patchthecve.com/cve/CVE-2024-41960.htmlWed, 17 Jun 2026 07:48:31 +0000LOW 3.8: mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scripts https://patchthecve.com/cve/CVE-2024-41959.htmlhttps://patchthecve.com/cve/CVE-2024-41959.htmlWed, 17 Jun 2026 07:48:31 +0000HIGH 7.6: mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the uhttps://patchthecve.com/cve/CVE-2024-41958.htmlhttps://patchthecve.com/cve/CVE-2024-41958.htmlWed, 17 Jun 2026 07:48:31 +0000MEDIUM 6.6: mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accounts that are otherwis