Mail server does not generate a unique key during installation, as exploited in the wild per CISA KEV.
CVE-2017-14623
LDAP Go package allows authentication bypass using an empty password, causing an unauthenticated LDAP bind
CVE-2009-3421