gfi_kerioconnect vulnerabilities

CVEs whose affected-version data names the gfi_kerioconnect package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112353High· 8.2

yesterday

GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading…

▾ TwilightGFI USA, LLC · GFI KerioConnectvia CVEORG