Vulnerabilities

Filters

1 selected

16 records

Sort

Vendor: axllent Clear all filters

TI-2026-58225 CVE-2026-84697 · GHSA-qx8f-9cjx-54j9

Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix

LOW 37

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00397 Published 2026-09-02 No fix listed CWE-918

TI-2026-47726 CVE-2026-67448 · GHSA-8r62-w5wh-fc5m

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

LOW 28

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00221 Published 2026-08-20 Fixed in 1.30.6 CWE-177

TI-2026-47725 CVE-2026-67447 · GHSA-r553-m4fv-5v97

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

MEDIUM 63

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2026-08-20 Fixed in 1.30.5 CWE-770

TI-2026-47723 CVE-2026-67445 · GHSA-w878-pj84-3j5v

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

LOW 31

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2026-08-20 Fixed in 1.30.4 CWE-400

TI-2026-47724 CVE-2026-67446 · GHSA-75mr-qw9x-3r39

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

MEDIUM 63

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2026-08-20 Fixed in 1.30.4 CWE-400

TI-2026-36093 CVE-2026-48824 · GHSA-28pq-6qxg-wg5r

Resource allocation without limits in axllent mailpit

LOW 31

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00541 Published 2026-07-20 Fixed in 1.30.1 CWE-770

TI-2026-33452 CVE-2026-45713 · GHSA-fpxj-m5q8-fphw

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

HIGH 72

Mailpit is an email testing tool and API for developers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2026-07-20 Fixed in 1.30.0 CWE-400

TI-2026-33451 CVE-2026-45712 · GHSA-w4vj-r5pg-3722

Race condition in axllent mailpit

MEDIUM 60

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00336 Published 2026-07-20 Fixed in 1.30.0 CWE-362

TI-2026-33450 CVE-2026-45711 · GHSA-qx5x-85p8-vg4j

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

HIGH 69

Mailpit is an email testing tool and API for developers.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00389 Published 2026-07-20 Fixed in 1.30.0 CWE-22

TI-2026-33449 CVE-2026-45709 · GHSA-j3fj-qppj-fmmc

Server-side request forgery in axllent mailpit

LOW 32

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00316 Published 2026-07-20 Fixed in 1.30.0 CWE-918

TI-2026-39868 CVE-2026-55187 · GHSA-w4mc-hhc6-xp28

Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)

HIGH 65

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00354 Published 2026-07-10 Fixed in 1.30.2 CWE-918

TI-2026-22161 CVE-2026-27808 · GHSA-mpf7-p9x7-96r3

Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API

HIGH 76

Mailpit is an email testing tool and API for developers.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00532 Published 2026-02-25 Fixed in 1.29.2 CWE-918

TI-2026-19208 CVE-2026-23845 · GHSA-6jxm-fv7w-rw5j

Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API

LOW 39

Mailpit is an email testing tool and API for developers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00431 Published 2026-01-19 Fixed in 1.28.3 CWE-918

TI-2026-19194 CVE-2026-23829 · GHSA-54wq-72mp-cq7c

Mailpit has SMTP Header Injection via Regex Bypass

MEDIUM 63

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01402 Published 2026-01-18 Fixed in 1.28.3 CWE-150

TI-2026-18216 CVE-2026-22689 · GHSA-524m-q5m7-79mm

Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

LOW 28

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00239 Published 2026-01-10 Fixed in 1.28.2, 0.0.0-20260110031614 CWE-1385

TI-2026-17561 CVE-2026-21859 · GHSA-8v65-47jx-7mfr

Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)

HIGH 65

Mailpit is an email testing tool and API for developers.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00806 Published 2026-01-07 Fixed in 1.28.1 CWE-918