Offlineimap is a niche command-line utility for synchronizing IMAP mailboxes to local storage, presenting a focused vulnerability surface around its mail-protocol handling. The observed weakness class centers on improper certificate validation, reflecting the security demands of remote email server authentication. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Offlineimap over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-37248MEDIUM OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and e | Jun 8, 2026 | 6.5 | 28 | NO | NO |
CVE-2010-4533CRITICAL offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security defi | Nov 13, 2019 | 9.8 | 28 | NO | NO |
CVE-2010-4532MEDIUM offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks. | Nov 13, 2019 | 5.9 | 19 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Offlineimap.
Media articles that mention a CVE ID that affects a product developed by Offlineimap — matched by CVE ID, not by vendor name.