Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

CVE-2026-67446

creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:04+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39 2026-09-03 07:31:59+00:00| seen| https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c...

PT-2026-6508

Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit...