axllent mailpit

• CVE-2026-84697 Medium 5.3 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix 0.4%
• CVE-2026-67448 Medium 6.5 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) 0.2%
• CVE-2026-67447 Medium 5.3 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement 0.5%
• CVE-2026-67445 Medium 5.3 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection 0.5%
• CVE-2026-67446 Medium 5.3 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling 0.5%
• CVE-2026-48824 Medium 5.3 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) 0.5%
• CVE-2026-45713 High 7.5 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes 0.6%
• CVE-2026-45712 Medium 5.9 Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) 0.3%
• CVE-2026-45711 Medium 5.9 Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs 0.4%
• CVE-2026-45709 Medium 5.8 Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer 0.3%
• CVE-2026-55187 Medium 5.8 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) 0.4%
• CVE-2026-27808 Medium 5.8 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API 0.5%
• CVE-2026-23845 Medium 5.8 Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API 0.4%
• CVE-2026-23829 Medium 5.3 Mailpit has SMTP Header Injection via Regex Bypass 1.4%
• CVE-2026-22689 Medium 6.5 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails 0.2%
• CVE-2026-21859 Medium 5.8 Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF) 0.8%