How many CVEs does Open-Xchange have?

Open-Xchange has 293 published CVE records since 2006, including 23 in the last two years.

How many Open-Xchange CVEs are in CISA KEV?

None of Open-Xchange's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Open-Xchange products have the most CVEs?

The Open-Xchange products with the most published CVEs are open-xchange appsuite, OX App Suite, appsuite-frontend, OX Dovecot Pro, dovecot.

What are the most common weakness types in Open-Xchange CVEs?

Open-Xchange's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-918 (Server-Side Request Forgery (SSRF)).

How many critical Open-Xchange vulnerabilities are there?

Open-Xchange has 13 critical and 45 high-severity CVEs.

What is the average severity of Open-Xchange CVEs?

The average CVSS base score across Open-Xchange's scored CVEs is 6.0.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

293 CVEs

Open-Xchange Vulnerabilities

Name: Open-Xchange vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Open-Xchange.

293

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

136

Public exploits

PoC or exploit code

6.0

Avg CVSS

2006–2026

Overview

Open-Xchange has 293 published CVE records since 2006, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 136 have a known public exploit. The average CVSS base score across scored CVEs is 6.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Open-Xchange products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Open-Xchange's vulnerability posture, as a share of its 293 published CVEs.

Average CVSS: 6.0
Critical / high: 20%
Actively exploited (KEV): 0%
Public exploit available: 46%
Patch available: 39%

Severity and exploitation

How the CVSS severity of Open-Xchange's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical13

High45

Medium226

Low9

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Open-Xchange's CVEs are currently listed in CISA's KEV catalog.

Public exploits

136

136 of Open-Xchange's CVEs have a known public exploit available.

Most affected products

The Open-Xchange products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Open-Xchange CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Open-Xchange CVE records.

Disclosure activity by year

How many Open-Xchange CVEs were published each year.

2019

34

2020

21

2021

37

2022

23

2023

47

2024

25

2025

7

2026

16

Latest Open-Xchange CVEs

The most recently disclosed vulnerabilities affecting Open-Xchange.

High vulnerability · 2026-05-12
CWE-400
High · CVSS 7.5
EPSS 0.5%2026-05-12
Medium vulnerability · 2026-05-12
CWE-284
Medium · CVSS 4.3
EPSS 0.3%2026-05-12
Medium vulnerability · 2026-05-12
CWE-400
Medium · CVSS 6.5
EPSS 0.3%2026-05-12
Medium vulnerability · 2026-05-12
CWE-99
Medium · CVSS 6.8
EPSS 0.2%2026-05-12
Critical vulnerability · 2026-05-12
CWE-235
Critical · CVSS 9.1
EPSS 0.4%2026-05-12
Medium vulnerability · 2026-03-27
CWE-90
Medium · CVSS 5.3
EPSS 0.3%2026-03-27
Medium vulnerability · 2026-03-27
CWE-400
Medium · CVSS 5.3
EPSS 0.4%2026-03-27
High vulnerability · 2026-03-27
CWE-400
High · CVSS 7.5
EPSS 0.8%2026-03-27
High vulnerability · 2026-03-27
CWE-400
High · CVSS 7.5
EPSS 0.7%2026-03-27
High vulnerability · 2026-03-27
CWE-287
High · CVSS 7.4
EPSS 0.4%2026-03-27
Medium vulnerability · 2026-03-27
CWE-294
Medium · CVSS 6.8
EPSS 0.3%2026-03-27
High vulnerability · 2026-03-27
CWE-89
High · CVSS 8.2
EPSS 0.4%2026-03-27

Track new Open-Xchange CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Open-Xchange CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Nagios303 CVEs sourceware297 CVEs discourse296 CVEs Eclipse Foundation290 CVEs Progress289 CVEs PDF-XChange289 CVEs Splunk287 CVEs xwiki285 CVEs

Browse all vendors

Frequently asked questions

Common questions about Open-Xchange vulnerabilities.

How many CVEs does Open-Xchange have?: Open-Xchange has 293 published CVE records since 2006, including 23 in the last two years.
How many Open-Xchange CVEs are in CISA KEV?: None of Open-Xchange's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Open-Xchange products have the most CVEs?: The Open-Xchange products with the most published CVEs are open-xchange appsuite, OX App Suite, appsuite-frontend, OX Dovecot Pro, dovecot.
What are the most common weakness types in Open-Xchange CVEs?: Open-Xchange's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-918 (Server-Side Request Forgery (SSRF)).
Are there public exploits for Open-Xchange vulnerabilities?: Yes — 136 of Open-Xchange's CVEs have a known public exploit.
How many critical Open-Xchange vulnerabilities are there?: Open-Xchange has 13 critical and 45 high-severity CVEs.
What is the average severity of Open-Xchange CVEs?: The average CVSS base score across Open-Xchange's scored CVEs is 6.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Open-Xchange vulnerabilities

Monitor new Open-Xchange vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing