https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:58:26.165916+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-23845 CVE-2026-23845 — Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API 2026-10-07T07:58:26.182689+00:00

Affected: axllent mailpit

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.