What’s Vulnerable › Products
axllent mailpit vulnerabilities
16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your axllent mailpit version is affected
Latest axllent mailpit vulnerabilities
- CVE-2026-84697 — Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix (CVSS 5.3)
- CVE-2026-67448 — Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) (CVSS 6.5)
- CVE-2026-67447 — Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement (CVSS 5.3)
- CVE-2026-67446 — Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling (CVSS 5.3)
- CVE-2026-67445 — Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection (CVSS 5.3)
- CVE-2026-48824 — Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) (CVSS 5.3)
- CVE-2026-45713 — Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes (CVSS 7.5)
- CVE-2026-45712 — Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) (CVSS 5.9)
- CVE-2026-45711 — Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (CVSS 8.2)
- CVE-2026-45709 — Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer (CVSS 5.8)
- CVE-2026-55187 — Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) (CVSS 5.8)
- CVE-2026-27808 — Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API (CVSS 8.6)
- CVE-2026-23845 — Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API (CVSS 7.5)
- CVE-2026-23829 — Mailpit has SMTP Header Injection via Regex Bypass (CVSS 5.3)
- CVE-2026-22689 — Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails (CVSS 6.5)
- CVE-2026-21859 — Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF) (CVSS 5.3)