CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

CVE-2026-45713

Mailpit suffers an unauthenticated remote memory-exhaustion DoS due to missing limits on SMTP DATA and the /api/v1/send body. Before v1.30.0, Server.MaxSize is not assigned, allowing unbounded data growth and RAM/disk pressure as messages are processed and stored. Multiple sources (CVE-2026-45713...

CVE-2026-45712

CVE-2026-45712 concerns Mailpit's proxy CSS rewriter exposing a race condition: an unsynchronized read of a package-level assets map occurs concurrently with writes under the assetsMutex, causing a runtime panic (concurrent map read and map write) and a full Mailpit process crash, taking SMTP/POP...

CVE-2026-55187

Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incomplete because the tools.IsInternalIP deny-list in internal/tools/net.go relies on Go's standard library classification helpers and does not block IPv6 transition mechanisms...

CVE-2026-25658

CVE-2026-25658 affects Ericsson Packet Core Gateway (PCG) versions prior to 1.30. The issue is an Improper Handling of Missing Values (CWE-230) where a client can send specially crafted messages to cause service degradation. The impact persists while the attack continues, with crashes recovering ...

Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-da68d7bf53)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-da68d7bf53 advisory. nginx-mod-headers-more: - Rebuild for 1.30.2 nginx-mod-vts: - Rebuild for 1.30.2 nginx-mod-fancyindex: - Rebuild for 1.30.2 nginx-mod-brotli: - Rebuild for...

Edimax EW-7438RPn 安全漏洞

The Edimax EW-7438RPn is a wireless signal extender produced by Edimax of Taiwan, China. Versions of Edimax EW-7438RPn prior to 1.31 contained a security vulnerability. This vulnerability stemmed from the formWirelessTbl function in the webs component files and/goform/formWirelessTbl, which handl...

CVE-2026-40449

Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0...

[SECURITY] Fedora 42 Update: mongo-c-driver-1.30.7-2.fc42

mongo-c-driver is a client library written in C for MongoDB...

EUVD-2023-60540

Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This issue affects pnGate: through 1.30 epGate: through 1.30 mbGate: through 1.30 smartLink HW-DP: through 1.30 smartLink HW-PN: through 1.01...

CVE-2020-37191

Top Password Software Dialup Password Recovery 1.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting a large 5000-character payload into the User Name and Registration Code...

Top Password MSN Password Recovery 代码问题漏洞

Top Password MSN Password Recovery is a MSN password recovery tool developed by Top Password Inc. Version 1.30 of Top Password MSN Password Recovery has a code vulnerability that stems from XML external entity injection, which may lead to the reading of local system files...

WordPress Hubbub Lite plugin < 1.32.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Tycho Niestadt in WordPress Plugin Hubbub Lite versions 1.32.0...

Linux Distros Unpatched Vulnerability : CVE-2026-25234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow a...

EUVD-2025-200310

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popu...

Fedora 42 : kubernetes1.34 (2025-4c576d1bd9)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4c576d1bd9 advisory. - Update to release v1.34.2 - Resolves: rhbz2398589, rhbz2398850, rhbz2399251, rhbz2399524 - Resolves: rhbz2407790, rhbz2408060, rhbz2408317,...

CVE-2025-62694

CVE-2025-62694 is a stored XSS in the Wikimedia Foundation MediaWiki WikiLove Extension (version 1.39). The root cause is improper neutralization of input during web page generation. This issue is described across multiple feeds as affecting the WikiLove Extension: 1.39, with a CVSS v4 base score...

Backdrop CMS 安全漏洞

Backdrop CMS is a content management system CMS from Backdrop CMS open source. A security vulnerability exists in Backdrop CMS version 1.30, which stems from a cross-site scripting vulnerability in the node creation form...

Sony SNC-M1 安全漏洞

Sony SNC-M1 is a webcam from Sony Japan. A security vulnerability exists in Sony SNC-M1 version 1.30 and earlier, which stems from the use of default credentials in the management interface...