Bulwarkmail
5 CVEs across 1 Bulwarkmail products. Browse Bulwarkmail vulnerabilities, severities, and proof-of-concept exploits.
Bulwarkmail products with known CVEs
Bulwarkmail CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-35391 | High | 7.5 | 2026-04-06 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first… |
CVE-2026-35390 | Medium | 5.4 | 2026-04-06 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-… |
CVE-2026-35389 | High | 7.5 | 2026-04-06 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust… |
CVE-2026-34834 | High | 7.5 | 2026-04-02 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned… |
CVE-2026-34833 | High | 7.5 | 2026-04-02 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the u… |