CVE-2020-15954:
KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.
CVE-2021-38373:
In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/k/ksmtp.png){kind=link}