TI-2026-22161 CVE-2026-27808 · GHSA-mpf7-p9x7-96r3
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
Priority HIGH 76
Mailpit is an email testing tool and API for developers.
axllent
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
axllent records in CISA KEVNo axllent vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records
TI-2026-33452 CVE-2026-45713 · GHSA-fpxj-m5q8-fphw
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Priority HIGH 72
Mailpit is an email testing tool and API for developers.
TI-2026-33450 CVE-2026-45711 · GHSA-qx5x-85p8-vg4j
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Priority HIGH 69
Mailpit is an email testing tool and API for developers.
TI-2026-39868 CVE-2026-55187 · GHSA-w4mc-hhc6-xp28
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)
Priority HIGH 65
Mailpit is an email testing tool and API for developers.
TI-2026-17561 CVE-2026-21859 · GHSA-8v65-47jx-7mfr
Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
Priority HIGH 65
Mailpit is an email testing tool and API for developers.
TI-2026-47725 CVE-2026-67447 · GHSA-r553-m4fv-5v97
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
Priority MEDIUM 63
Mailpit is an email testing tool and API for developers.
TI-2026-47724 CVE-2026-67446 · GHSA-75mr-qw9x-3r39
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Priority MEDIUM 63
Mailpit is an email testing tool and API for developers.
TI-2026-19194 CVE-2026-23829 · GHSA-54wq-72mp-cq7c
Mailpit has SMTP Header Injection via Regex Bypass
Priority MEDIUM 63
Mailpit is an email testing tool and API for developers.
TI-2026-33451 CVE-2026-45712 · GHSA-w4vj-r5pg-3722
Race condition in axllent mailpit
Priority MEDIUM 60
Mailpit is an email testing tool and API for developers.
TI-2026-19208 CVE-2026-23845 · GHSA-6jxm-fv7w-rw5j
Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
Priority LOW 39
Mailpit is an email testing tool and API for developers.
TI-2026-58225 CVE-2026-84697 · GHSA-qx8f-9cjx-54j9
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Priority LOW 37
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations.
TI-2026-33449 CVE-2026-45709 · GHSA-j3fj-qppj-fmmc
Server-side request forgery in axllent mailpit
Priority LOW 32
Mailpit is an email testing tool and API for developers.
TI-2026-47723 CVE-2026-67445 · GHSA-w878-pj84-3j5v
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Priority LOW 31
Mailpit is an email testing tool and API for developers.
TI-2026-36093 CVE-2026-48824 · GHSA-28pq-6qxg-wg5r
Resource allocation without limits in axllent mailpit
Priority LOW 31
Mailpit is an email testing tool and API for developers.
TI-2026-47726 CVE-2026-67448 · GHSA-8r62-w5wh-fc5m
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Priority LOW 28
Mailpit is an email testing tool and API for developers.
TI-2026-18216 CVE-2026-22689 · GHSA-524m-q5m7-79mm
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
Priority LOW 28
Mailpit is an email testing tool and API for developers.