{"schema_version":1,"title":"modoboa (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in modoboa (PyPI): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2023-0860, was published on 7 July 2026.","url":"https://junglewise.ai/threats/technologies/pypi-modoboa","json_url":"https://junglewise.ai/threats/technologies/pypi-modoboa.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pypi-modoboa","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":16,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":2},"latest":[{"cve":"CVE-2023-0860","cvss":3.1,"epss":0.0066,"slug":"cve-2023-0860-improper-restriction-of-excessive-authentication-attempts-in","title":"PYSEC-2026-849 - Improper Restriction of Excessive Authentication Attempts in modoboa","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:27.764359+00:00","url":"https://junglewise.ai/threats/cve-2023-0860-improper-restriction-of-excessive-authentication-attempts-in"},{"cve":"CVE-2026-27602","cvss":3.1,"epss":0.0069,"slug":"cve-2026-27602-modoboa-has-os-command-injection","title":"PYSEC-2026-2223 - Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess","severity":"low","exploited":false,"published_at":"2026-03-25T19:16:48.43+00:00","url":"https://junglewise.ai/threats/cve-2026-27602-modoboa-has-os-command-injection"},{"cve":"CVE-2023-5690","cvss":3.1,"epss":0.0043,"slug":"cve-2023-5690-modoboa-cross-site-request-forgery-vulnerability","title":"PYSEC-2023-217 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5690-modoboa-cross-site-request-forgery-vulnerability"},{"cve":"CVE-2023-5689","cvss":3.1,"epss":0.0051,"slug":"cve-2023-5689-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-216 - Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5689-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-5688","cvss":3.1,"epss":0.0057,"slug":"cve-2023-5688-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-215 - Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5688-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-2228","cvss":3.1,"epss":0.0038,"slug":"cve-2023-2228-modoboa-vulnerable-to-cross-site-request-forgery","title":"PYSEC-2023-36 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.","severity":"low","exploited":false,"published_at":"2023-04-21T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-2228-modoboa-vulnerable-to-cross-site-request-forgery"},{"cve":"CVE-2023-2227","cvss":3.1,"epss":0.4403,"slug":"cve-2023-2227-improper-authorization-in-modoboa","title":"PYSEC-2023-35 - Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.","severity":"low","exploited":false,"published_at":"2023-04-21T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-2227-improper-authorization-in-modoboa"},{"cve":"CVE-2023-2160","cvss":3,"epss":0.0062,"slug":"cve-2023-2160-modoboa-has-weak-password-requirements","title":"PYSEC-2023-34 - Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.","severity":"low","exploited":false,"published_at":"2023-04-18T16:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-2160-modoboa-has-weak-password-requirements"},{"cve":"CVE-2023-0949","cvss":3.1,"epss":0.005,"slug":"cve-2023-0949-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-33 - Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.","severity":"low","exploited":false,"published_at":"2023-02-22T09:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0949-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-0777","cvss":3.1,"epss":0.1521,"slug":"cve-2023-0777-authentication-bypass-in-modoboa","title":"PYSEC-2023-32 - Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-02-10T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0777-authentication-bypass-in-modoboa"},{"cve":"CVE-2023-0519","cvss":3,"epss":0.005,"slug":"cve-2023-0519-cross-site-scripting-in-modoboa","title":"PYSEC-2023-31 - Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-26T23:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0519-cross-site-scripting-in-modoboa"},{"cve":"CVE-2023-0470","cvss":3,"epss":0.0062,"slug":"cve-2023-0470-cross-site-scripting-in-modoboa","title":"PYSEC-2023-30 - Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-26T22:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0470-cross-site-scripting-in-modoboa"},{"cve":"CVE-2023-0438","cvss":3.1,"epss":0.0035,"slug":"cve-2023-0438-cross-site-request-forgery-in-modoboa","title":"PYSEC-2023-284 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-23T14:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0438-cross-site-request-forgery-in-modoboa"},{"cve":"CVE-2023-0406","cvss":3.1,"epss":0.0039,"slug":"cve-2023-0406-cross-site-request-forgery-in-modoboa","title":"PYSEC-2023-283 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-19T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0406-cross-site-request-forgery-in-modoboa"},{"cve":"CVE-2023-0398","cvss":3.1,"epss":0.0035,"slug":"cve-2023-0398-modoboa-is-vulnerable-to-cross-site-request-forgery","title":"PYSEC-2023-282 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-19T09:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0398-modoboa-is-vulnerable-to-cross-site-request-forgery"},{"cvss":3.1,"slug":"pysec-2019-251-the-modoboa-dmarc-plugin-1-1-0-for-modoboa-is-vulnerable-46300d0a","title":"PYSEC-2019-251 - The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote","severity":"low","exploited":false,"published_at":"2019-12-10T20:15:00+00:00","url":"https://junglewise.ai/threats/pysec-2019-251-the-modoboa-dmarc-plugin-1-1-0-for-modoboa-is-vulnerable-46300d0a"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"tensorflow (PyPI)","slug":"pypi-tensorflow","vulnerabilities":428,"url":"https://junglewise.ai/threats/technologies/pypi-tensorflow"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":424,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":421,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":177,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"Django (PyPI)","slug":"django","vulnerabilities":172,"url":"https://junglewise.ai/threats/technologies/django"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":152,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"plone (PyPI)","slug":"pypi-plone","vulnerabilities":101,"url":"https://junglewise.ai/threats/technologies/pypi-plone"},{"name":"praisonai (PyPI)","slug":"pypi-praisonai","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/pypi-praisonai"},{"name":"exiv2 (PyPI)","slug":"exiv2","vulnerabilities":85,"url":"https://junglewise.ai/threats/technologies/exiv2"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"name":"pillow (PyPI)","slug":"pillow","vulnerabilities":79,"url":"https://junglewise.ai/threats/technologies/pillow"}],"technology":{"hub":true,"name":"modoboa (PyPI)","slug":"pypi-modoboa","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"description":"Open-source mailbox hosting platform with web interface, IMAP/POP3 support, and mail management.","url":"https://junglewise.ai/threats/technologies/pypi-modoboa"},"most_severe":[{"cve":"CVE-2023-2227","cvss":3.1,"epss":0.4403,"slug":"cve-2023-2227-improper-authorization-in-modoboa","title":"PYSEC-2023-35 - Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.","severity":"low","exploited":false,"published_at":"2023-04-21T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-2227-improper-authorization-in-modoboa"},{"cve":"CVE-2023-0777","cvss":3.1,"epss":0.1521,"slug":"cve-2023-0777-authentication-bypass-in-modoboa","title":"PYSEC-2023-32 - Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-02-10T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0777-authentication-bypass-in-modoboa"},{"cve":"CVE-2026-27602","cvss":3.1,"epss":0.0069,"slug":"cve-2026-27602-modoboa-has-os-command-injection","title":"PYSEC-2026-2223 - Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess","severity":"low","exploited":false,"published_at":"2026-03-25T19:16:48.43+00:00","url":"https://junglewise.ai/threats/cve-2026-27602-modoboa-has-os-command-injection"},{"cve":"CVE-2023-0860","cvss":3.1,"epss":0.0066,"slug":"cve-2023-0860-improper-restriction-of-excessive-authentication-attempts-in","title":"PYSEC-2026-849 - Improper Restriction of Excessive Authentication Attempts in modoboa","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:27.764359+00:00","url":"https://junglewise.ai/threats/cve-2023-0860-improper-restriction-of-excessive-authentication-attempts-in"},{"cve":"CVE-2023-5688","cvss":3.1,"epss":0.0057,"slug":"cve-2023-5688-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-215 - Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5688-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-5689","cvss":3.1,"epss":0.0051,"slug":"cve-2023-5689-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-216 - Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5689-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-0949","cvss":3.1,"epss":0.005,"slug":"cve-2023-0949-modoboa-cross-site-scripting-vulnerability","title":"PYSEC-2023-33 - Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.","severity":"low","exploited":false,"published_at":"2023-02-22T09:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0949-modoboa-cross-site-scripting-vulnerability"},{"cve":"CVE-2023-5690","cvss":3.1,"epss":0.0043,"slug":"cve-2023-5690-modoboa-cross-site-request-forgery-vulnerability","title":"PYSEC-2023-217 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.","severity":"low","exploited":false,"published_at":"2023-10-20T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-5690-modoboa-cross-site-request-forgery-vulnerability"},{"cve":"CVE-2023-0406","cvss":3.1,"epss":0.0039,"slug":"cve-2023-0406-cross-site-request-forgery-in-modoboa","title":"PYSEC-2023-283 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.","severity":"low","exploited":false,"published_at":"2023-01-19T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-0406-cross-site-request-forgery-in-modoboa"},{"cve":"CVE-2023-2228","cvss":3.1,"epss":0.0038,"slug":"cve-2023-2228-modoboa-vulnerable-to-cross-site-request-forgery","title":"PYSEC-2023-36 - Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.","severity":"low","exploited":false,"published_at":"2023-04-21T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-2228-modoboa-vulnerable-to-cross-site-request-forgery"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}