CVE-2018-15586: Enigmail

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.

Affected products

• Enigmail Enigmail: before 2.0.6 (fixed in 2.0.6)

Published 2019-02-11. Last modified 2026-06-17.