CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:00 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product seppmail:secure_email_gateway. Show all products

15 CVEs, showing 1 to 15

CVE	Severity	Title	Published
CVE-2026-84830	High 8.6	OS command injection in privileged configuration handling Assigned by NCSC.ch	Sep 3, 2026
CVE-2026-29144	Medium 5.3	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike characters.	Apr 2, 2026
CVE-2026-29143	Critical 9.1	SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to control trusted headers.	Apr 2, 2026
CVE-2026-29142	Medium 5.3	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email.	Apr 2, 2026
CVE-2026-29141	Medium 5.3	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK].	Apr 2, 2026
CVE-2026-29140	Medium 5.3	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled certificates to be used for future encryption to a victim by adding the certificates to S/MIME sign…	Apr 2, 2026
CVE-2026-29139	Critical 9.8	SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.	Apr 2, 2026
CVE-2026-29138	High 7.5	SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.	Apr 2, 2026
CVE-2026-29137	Medium 5.3	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to hide security tags from users by crafting a long subject.	Apr 2, 2026
CVE-2026-29136	Medium 6.1	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates.	Apr 2, 2026
CVE-2026-29135	High 7.5	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization.	Apr 2, 2026
CVE-2026-29134	High 7.5	SEPPmail Secure Email Gateway before version 15.0.3 allows an external user to modify GINA webdomain metadata and bypass per-domain restrictions.	Apr 2, 2026
CVE-2026-29133	Critical 9.1	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address.	Apr 2, 2026
CVE-2026-29132	High 7.5	SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protected emails.	Apr 2, 2026
CVE-2026-29131	High 7.5	SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users.	Apr 2, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.