CVE-2026-44742

—

CVSS 3.1

6.1 medium

EPSS

<1%p15

Published

May 7, 2026 (May 7, 2026)

Modified

Jun 17, 2026

Description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

Vendors: postorius project
Products: postorius
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.