https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-49395.htmlhttps://patchthecve.com/cve/CVE-2024-49395.htmlFri, 26 Jun 2026 02:16:50 +0000MEDIUM 5.3: In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.https://patchthecve.com/cve/CVE-2024-49394.htmlhttps://patchthecve.com/cve/CVE-2024-49394.htmlFri, 26 Jun 2026 02:16:50 +0000MEDIUM 5.3: In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.https://patchthecve.com/cve/CVE-2024-49393.htmlhttps://patchthecve.com/cve/CVE-2024-49393.htmlFri, 26 Jun 2026 02:16:50 +0000MEDIUM 6.5: In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.