CVE-2025-59937 go-mail has insufficient address encoding when passing mail addresses to the SMTP client

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong...

CVE-2025-59937 go-mail has insufficient address encoding when passing mail addresses to the SMTP client

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong...

GHSA-G99P-47X7-MQ88 go-f3 module vulnerable to integer overflow leading to panic

Impact Filecoin nodes consuming F3 messages are vulnerable. go-f3 panics when it validates a "poison" messages. A "poison" message can can cause integer overflow in the signer index validation. In Lotus' case, the whole node will crash. There is no barrier to entry. An attacker doesn't need any...

go-f3 Vulnerable to Cached Justification Verification Bypass

Description A vulnerability exists in go-f3's justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by: 1. First submitting a valid message with a correct...

GHSA-7PQ9-RF9P-WCRF go-f3 Vulnerable to Cached Justification Verification Bypass

Description A vulnerability exists in go-f3's justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by: 1. First submitting a valid message with a correct...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via improper handling of the mail.Address value. An attacker can manipulate email routing or inject unauthorized SMTP parameters by supplying specially crafted email addresses. Note: This is only exploitable...

go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Impact Due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling. Vulnerability details Instead ...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via improper handling of the mail.Address value. An attacker can manipulate email routing or inject unauthorized SMTP parameters by supplying specially crafted email addresses. Note: This is only exploitable...

GHSA-WPWJ-69CM-Q9C5 go-mail has insufficient address encoding when passing mail addresses to the SMTP client

Impact Due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling. Vulnerability details Instead ...

Security Bulletin: Buffer overflow, uncontrolled recursion, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to buffer overflow, uncontrolled recursion, and other. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-7969 DESCRIPTION: Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site...

Linux Distros Unpatched Vulnerability : CVE-2025-11065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information...

PT-2025-39914

Name of the Vulnerable Software and Affected Versions go-mail versions 0.7.0 and below Description The go-mail library improperly handles mail.Address values when passed to the SMTP client’s MAIL FROM or RCPT TO commands. This can lead to incorrect address routing or ESMTP parameter smuggling...

go-mail 参数注入漏洞

go-mail is a Golang library with mail sending functionality by the individual developer Winni Neessen. A parameter injection vulnerability exists in go-mail version 0.7.0 and earlier, which stems from mishandling of the mail.Address value, which can lead to incorrect address routing or ESMTP...

PT-2025-39917

Name of the Vulnerable Software and Affected Versions go-f3 versions 0.8.6 and earlier Description go-f3 is a Golang implementation of Fast Finality for Filecoin F3. Versions 0.8.6 and below experience a panic when validating specific "poison" messages. These messages can trigger an integer...

Unitree多款产品 安全漏洞

Unitree Go2 is a robot dog, Unitree G1 is a humanoid robot, and Unitree H1 is a humanoid robot. A security vulnerability exists in various Unitree products that originates from the acceptance of an arbitrary handshake key containing a substring of unitree. The following products and versions are...

Exploit for CVE-2025-22294

CVE-2025-2294 – Local File Inclusion LFI в WordPress-плагине...

MAL-2025-47592 Malicious code in notificare-go-web (npm)

The package notificare-go-web was found to contain malicious code...

Malicious code in notificare-go-web (npm)

The package notificare-go-web was found to contain malicious code...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.58 security and extras update

Red Hat OpenShift Container Platform release 4.15.58 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a security impact of...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: tempo, cni-plugins, tflint, trivy, lazydocker, cloud-provider-gcp-cloud-controller-manager, ratify, cluster-api-azure-controller, nri-f5, zot, nri-nginx, kapp, ipfs-cluster, k3d, kube-bench, kubernetes-csi-driver-nfs, mockgen, nginx-prometheus-exporter,...