axllent vulnerabilities

Newest CVEs

• CVE-2026-84697

  Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix

  axllent · mailpit

  Medium6.9
• CVE-2026-67448

  Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

  axllent · mailpit

  Medium6.5
• CVE-2026-67447

  Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

  axllent · mailpit

  Medium5.3
• CVE-2026-67445

  Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

  axllent · mailpit

  Medium5.3
• CVE-2026-67446

  Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

  axllent · mailpit

  Medium5.3
• CVE-2026-48824

  Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

  axllent · mailpit

  Medium5.3
• CVE-2026-45713

  Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

  axllent · mailpit

  High7.5
• CVE-2026-45712

  Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

  axllent · mailpit

  Medium5.9
• CVE-2026-45711

  Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

  axllent · mailpit

  Medium5.9
• CVE-2026-45709

  Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

  axllent · mailpit

  Medium5.8