Sogo
Vendor:
First CVE: Feb 3, 2017 · Active for 9 years
17
Total CVEs
More Total CVEs than 94% of tracked products
3.4
Avg CVEs / Year
Higher CVE frequency than 84% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 25% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Sogo over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 3, 2017
9 years ago
Most Recent CVE
May 14, 2026
74 days ago
CVE Severity & Scoring
Sogo17 CVEs
76%
18%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network17 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (82.4%)
High3 (17.6%)
Unknown0 (0.0%)
User Interaction
None4 (23.5%)
Unknown0 (0.0%)
Required13 (76.5%)
Privileges Required
Low5 (29.4%)
High0 (0.0%)
None12 (70.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-46446HIGH SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin. | May 14, 2026 | 7.1 | 27 | NO | NO |
CVE-2026-46445HIGH SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. | May 14, 2026 | 7.1 | 27 | NO | NO |
CVE-2015-5395HIGH Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. | Sep 20, 2017 | 8.8 | 25 | NO | NO |
CVE-2016-6188MEDIUM Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment, related to temporar | Feb 3, 2017 | 6.5 | 24 | NO | NO |
CVE-2025-71276MEDIUM SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories. | Mar 22, 2026 | 6.1 | 22 | NO | NO |
CVE-2026-3054MEDIUM A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can b | Feb 24, 2026 | 6.1 | 22 | NO | NO |
CVE-2025-63499MEDIUM Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. | Dec 4, 2025 | 6.1 | 22 | NO | NO |
CVE-2025-63498MEDIUM alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. | Nov 24, 2025 | 6.1 | 22 | NO | NO |
CVE-2024-34462MEDIUM Alinto SOGo through 5.10.0 allows XSS during attachment preview. | May 4, 2024 | 6.1 | 19 | NO | NO |
CVE-2023-48104MEDIUM Alinto SOGo before 5.9.1 is vulnerable to HTML Injection. | Jan 16, 2024 | 6.1 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (17 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (17 CVEs).
Media Mentions
Signals from CVEs in this product scope (17 CVEs).
Top CNAs Publishing CVEs For Sogo
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.12.4 | 1 | 6.1 | 0.4% | 0 | 0 |
| 5.12.3 | 2 | 6.1 | 0.3% | 0 | 0 |
| 2.3.7 | 1 | 6.5 | 2.1% | 0 | 0 |