https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:56:36.626480+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-fc13167 CLEANSTART-2026-FC13167 — aiosmtplib before 5 2026-10-03T09:56:36.630181+00:00

Affected: CleanStart: airflow-3

CVE-2026-90467 affects multiple packages. aiosmtplib before 5. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-368101 EUVD-2026-368101 2026-10-03T09:56:36.630225+00:00 EUVD-2026-368101 https://cve.radiocsirt.org/vuln/fkie_cve-2026-90467 fkie_cve-2026-90467 2026-10-03T09:56:36.630241+00:00

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

 https://cve.radiocsirt.org/vuln/ghsa-qh75-x5jv-g7wg GHSA-qh75-x5jv-g7wg 2026-10-03T09:56:36.630264+00:00

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11799-1 openSUSE-SU-2026:11799-1 — python313-aiosmtplib-5.1.3-1.1 on GA media 2026-10-03T09:56:36.630303+00:00

python313-aiosmtplib-5.1.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-90467 UBUNTU-CVE-2026-90467 2026-10-03T09:56:36.630334+00:00

Affected: Ubuntu:22.04:LTS: aiosmtplib, Ubuntu:26.04:LTS: aiosmtplib

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.