| CVE-2026-85111 |
Apache James: Denial of service upon MIME parsing
|
8.7
High
|
Nov 6, 2026 |
| CVE-2026-76168 |
Apache James: ManageSieve file implementation cross-user path traversal
|
Not rated
|
Nov 6, 2026 |
| CVE-2026-74756 |
Apache James: WebAdmin exposed without authentication on official Docker default
|
Not rated
|
Nov 6, 2026 |
| CVE-2026-76171 |
Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
|
Not rated
|
Nov 6, 2026 |
| CVE-2026-49939 |
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
|
Not rated
|
Nov 6, 2026 |
| CVE-2025-66621 |
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
|
Not rated
|
Nov 6, 2026 |
| CVE-2022-28220 |
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
|
Not rated
|
Sep 8, 2022 |
| CVE-2022-22931 |
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
|
Not rated
|
Feb 7, 2022 |
| CVE-2021-40525 |
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
|
Not rated
|
Jan 4, 2022 |
| CVE-2021-40111 |
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
|
Not rated
|
Jan 4, 2022 |
| CVE-2021-40110 |
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a…
|
Not rated
|
Jan 4, 2022 |
| CVE-2021-38542 |
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command
|
Not rated
|
Jan 4, 2022 |
| CVE-2017-12628 |
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization…
|
Not rated
|
Oct 20, 2017 |