CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...

CVE-2025-32781

CVE-2025-32781 affects Apollo Portal prior to 2.5.0, where an authenticated user can request a release by ID (GET /envs/{env}/releases/{releaseId}) with configView.memberOnly.envs enabled and read configuration data from other applications/namespaces. Root cause: missing application/namespace per...

FreeBSD : mail/mailpit -- memory-exhaustion DoS via unbounded JSON body (7ae38fde-5ab6-11f1-a242-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7ae38fde-5ab6-11f1-a242-10ffe07f9334 advisory. Mailpit author reports: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on...

mail/mailpit -- memory-exhaustion DoS via unbounded JSON body

Mailpit author reports: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/id/release...

EUVD-2026-14905

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

CVE-2026-29840

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

CVE-2026-29840

JiZhiCMS versions v2.5.6 and before are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability within the release function of the app/home/c/UserController.php file. The root cause is insufficient input cleaning ; while the application filters [removed] tags, it fails to recursively rem...

PT-2022-22521 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC, which can be exploited via the /release-x64/otfccdump+0x6b558f endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

PT-2022-22507 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A segmentation violation was discovered in OTFCC commit 617837b via the /release-x64/otfccdump+0x4fbbb6 endpoint. Recommendations: For OTFCC commit 617837b, consider restricting access to the...

PT-2022-22549 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue has been discovered in OTFCC commit 617837b via the "/release-x64/otfccdump+0x6e420d" endpoint. This issue can be exploited, potentially leading to security breaches...

PT-2022-22855 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A segmentation violation was discovered in OTFCC via the /release-x64/otfccdump+0x4fbbb6 endpoint. Recommendations: For OTFCC version 0.10.4, at the moment, there is no information about a newer version that...

PT-2022-22858 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A segmentation violation issue was discovered in OTFCC. The issue is related to the /release-x64/otfccdump+0x65f724 endpoint. Recommendations: For OTFCC version 0.10.4, consider avoiding the use of the...

PT-2022-22861 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A segmentation violation was discovered in OTFCC via the /release-x64/otfccdump+0x703969 endpoint. Recommendations: For OTFCC version 0.10.4, at the moment, there is no information about a newer version that...

PT-2022-22852 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A segmentation violation was discovered in OTFCC via the /release-x64/otfccdump+0x4fbc0b endpoint. Recommendations: For OTFCC version 0.10.4, at the moment, there is no information about a newer version that...

PT-2022-22836 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A heap-buffer overflow issue was discovered in OTFCC. The issue occurs via the /release-x64/otfccdump+0x6c0a32 endpoint. Recommendations: For OTFCC version 0.10.4, at the moment, there is no information about...

PT-2022-22860 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A segmentation violation was discovered in OTFCC, which can be triggered via the /release-x64/otfccdump+0x6b6a8f endpoint. Recommendations: For version 0.10.4, at the moment, there is no information about a...

PT-2022-22850 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC version 0.10.4 Description: A heap-buffer overflow issue was discovered in OTFCC. The issue can be exploited via the /release-x64/otfccdump+0x6b544e endpoint. Recommendations: For OTFCC version 0.10.4, at the moment, there is no...

CSRF vulnerability in m2release

m2release did not require that requests sent to the endpoint used to initiate the release process use POST. This resulted in a cross-site request forgery vulnerability that allows attackers to perform releases. m2release now requires that these requests be sent via POST...