CVE-2026-86009High· 8.2▾ MidnightPoC availableMailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator ena…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
0.3% → 0.4%
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Mailu < f05aeb8322e2f61096af6b089d61ba6f40587d96Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86008High· 7.2Mailu is a mail server distributed as a set of Docker images
CVE-2026-105703Medium· 4.7A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3
CVE-2026-85751Critical· 9.8Mailu is a mail server distributed as a set of Docker images
CVE-2026-115477High· 7.1obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2026-101006Medium· 4.3A flaw has been found in Frappe HR up to 16.15.0
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization