CVE-2026-48019 CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound...

ROOT-APP-MAVEN-CVE-2025-59419 CVE-2025-59419 in io.netty:netty-codec-smtp - Patched by Root

Root has patched CVE-2025-59419 in the io.netty:netty-codec-smtp package for Root:Maven. Multiple fixed versions available...

CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

EUVD-2026-63663

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...

GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...

CVE-2026-73570

CVE-2026-73570 PoC - Probador de Inyección de Comandos SMTP Un script personalizado de prueba de concepto PoC en Python de bajo nivel para probar vulnerabilidades de inyección de comandos SMTP CVE-2026-73570. Esta herramienta envía una dirección RCPT TO malformada que contiene sustitución de...

CVE-2026-82853

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol SMTP commands due to improper sanitization of carriage return and line feed characters in the transport name option. This can lead to email spoofing and phishing attacks...

CVE-2026-33604

A flaw was found in Dovecot. A remote attacker can exploit this by crafting a message with a specific line ending. If Dovecot relays this message, it can bypass security protections, allowing the attacker to inject spoofed email into a vulnerable downstream mail server. This vulnerability is...

CVE-2026-77351

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-77352

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

EUVD-2026-68884

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-77351

Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...

CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...

CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

CVE-2026-61638

CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...