CVE-2026-44742
Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.
- Update to 1.3.8-3+deb12u1
Published Updated
PatchFirst · Latest vulnerabilities
postorius vulnerabilities
Vulnerabilities published for postorius in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 2
CVE-2021-40347
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.
- Update to 1.3.5-1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.