5957 matches found
CVE-2026-67445
In Mailpit versions prior to 1.30.4, the SMTP command reader in internal/smtpd/smtpd.go uses bufio.Reader.ReadString before enforcing the RFC 5321 512-octet limit, allowing an unauthenticated remote attacker to send oversized command lines (including auth continuation lines) and exhaust memory, r...
CVE-2026-67445 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...
GHSA-H58C-XCCX-75M3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings
Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...
DEBIAN-CVE-2026-55558
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
UBUNTU-CVE-2026-55558
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
CVE-2026-55558
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
CVE-2026-55558 aiosmtplib: STARTTLS response injection
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
CVE-2026-55558
CVE-2026-55558 affects aiosmtplib , an asynchronous SMTP client for Python's asyncio, in versions prior to 5.1.2 . The vulnerability resides in SMTPProtocol.start_tls (src/aiosmtplib/protocol.py), which consumes the server's 220 response and initiates the TLS handshake without clearing SMTPProtoc...
CVE-2026-40686 vulnerabilities
Vulnerabilities for packages: exim...
CVE-2026-66140 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-Q496-Q274-JGH9 vulnerabilities
Vulnerabilities for packages: exim...
CVE-2026-66141 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-F965-GHFW-X6JX vulnerabilities
Vulnerabilities for packages: exim...
CVE-2026-40685 vulnerabilities
Vulnerabilities for packages: exim...
CVE-2026-48840 vulnerabilities
Vulnerabilities for packages: exim...
CVE-2026-45185 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-FHG4-WHCV-F8V4 vulnerabilities
Vulnerabilities for packages: exim...
GHSA-PPH6-FVMV-FJRC vulnerabilities
Vulnerabilities for packages: exim...