CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,265 CVEs published, 234 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,265
Show in the list
Critical, last 7 days
234
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product axllent:mailpit. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

16 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-21859Medium 5.8Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
Assigned by GitHub_M
Jan 7, 2026
CVE-2026-22689Medium 6.5Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
Assigned by GitHub_M
Jan 10, 2026
CVE-2026-23829Medium 5.3Mailpit has SMTP Header Injection via Regex Bypass
Assigned by GitHub_M
Jan 18, 2026
CVE-2026-23845Medium 5.8Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
Assigned by GitHub_M
Jan 19, 2026
CVE-2026-27808Medium 5.8Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
Assigned by GitHub_M
Feb 25, 2026
CVE-2026-55187Medium 5.8Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)
Assigned by GitHub_M
Jul 10, 2026
CVE-2026-45709Medium 5.8Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
Assigned by GitHub_M
Jul 20, 2026
CVE-2026-45711Medium 5.9Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Assigned by GitHub_M
Jul 20, 2026
CVE-2026-45712Medium 5.9Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
Assigned by GitHub_M
Jul 20, 2026
CVE-2026-45713High 7.5Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Assigned by GitHub_M
Jul 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .