{"vulnerability": "cve-2026-6744", "sightings": [{"uuid": "c60761f1-35a5-4035-a25f-9b4935a54940", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67443", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtf5gvi4ze2b", "content": "CVE-2026-67443 - fuxa\nA security issue in FUXA Node-RED versions 1.3.2 and earlier allows an attacker to access and control project data, scripts, and potentially operating-system commands without being\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fuxa #frangoteam #CVE #infosec", "creation_timestamp": "2026-08-18T21:20:05.575774Z"}, {"uuid": "5b30bb09-0243-47e8-a384-86758c22fb25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67443", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtfa5f6ln324", "content": "\ud83d\udea8 CVE-2026-67443 \u2014 CVSS 9.2 CRITICAL\n\nFUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDa...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-67443\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T22:08:28.634335Z"}, {"uuid": "d962fe86-b819-45b9-b2e8-fc39cb594e19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67447", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97", "content": "", "creation_timestamp": "2026-08-20T22:35:02.865450Z"}, {"uuid": "351152c2-6dde-483e-a0f3-aa81a1c9f953", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67443", "type": "published-proof-of-concept", "source": "Telegram/T_XByhyA_HALLjU76evu5RVvsn4zpzLoBf6fuRO_NOvcY2o", "content": "", "creation_timestamp": "2026-08-20T03:00:03.578303Z"}, {"uuid": "bfc6b5d4-248b-412a-ae2e-61d58011d881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67445", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v", "content": "", "creation_timestamp": "2026-09-03T00:35:02.806746Z"}, {"uuid": "4b29960e-df06-428a-9b06-4ff90f3eab07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67446", "type": "published-proof-of-concept", "source": "https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39", "content": "", "creation_timestamp": "2026-09-03T00:35:04.991658Z"}, {"uuid": "3f1d303a-4963-439f-a7b5-afd1d8f36d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67445", "type": "seen", "source": "https://gist.github.com/alon710/25d950fb1b775a5961200e6e2792284d", "content": "# CVE-2026-67445: CVE-2026-67445: Uncontrolled Memory Resource Consumption in Mailpit SMTP and POP3 Services\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67445\n\n## Summary\nAn uncontrolled resource consumption vulnerability in Mailpit versions prior to 1.30.4 allows remote, unauthenticated attackers to cause a denial of service (DoS) by sending unbounded command lines to the SMTP and POP3 servers. This memory exhaustion condition bypasses maximum message size limits.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust system memory and crash Mailpit by streaming long commands without a newline character to the SMTP or POP3 ports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS**: 5.3\n- **EPSS**: 0.00371 (30.14th percentile)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mailpit SMTP Server\n- Mailpit POP3 Server\n- **mailpit**: < 1.30.4 (Fixed in: `1.30.4`)\n\n## Mitigation\n\n- Upgrade the Mailpit package to version 1.30.4 or higher.\n- Restrict SMTP (port 1025) and POP3 (port 1110) traffic to local development networks or loopback interfaces.\n- Configure container memory limits to prevent host system crashes during memory exhaustion events.\n- Implement automatic process restart policies via systemd or Kubernetes to recover from crashes.\n\n**Remediation Steps:**\n1. Pull the latest Mailpit docker image: docker pull axllent/mailpit:latest\n2. If running local binaries, download v1.30.4 or rebuild using: go install github.com/axllent/mailpit@v1.30.4\n3. Apply firewall configurations restricting access to port 1025 and 1110.\n4. Verify the patch by running the memory consumption proof-of-concept against the updated service.\n\n## References\n\n- [GitHub Security Advisory GHSA-w878-pj84-3j5v](https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v)\n- [Mailpit Release Tag v1.30.4](https://github.com/axllent/mailpit/releases/tag/v1.30.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67445) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T05:32:21.089504Z"}, {"uuid": "6cd80f24-c129-4fa8-94f0-f49cd5785a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67446", "type": "seen", "source": "https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c", "content": "# CVE-2026-67446: CVE-2026-67446: Unbounded Image Dimension Decoding in Mailpit Thumbnail Generation\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67446\n\n## Summary\nMailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/{id}/part/{partID}/thumb endpoint. This allows remote, unauthenticated attackers to trigger unconstrained memory allocation and cause a Denial of Service (DoS) via resource exhaustion.\n\n## TL;DR\nUnauthenticated remote attackers can crash Mailpit servers by transmitting email attachments containing compressed images with extremely large logical dimensions, triggering out-of-memory errors during thumbnail generation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: Proof of Concept\n- **Impact**: Denial of Service (DoS)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mailpit\n- **Mailpit**: < v1.30.4 (Fixed in: `v1.30.4`)\n\n## Mitigation\n\n- Restrict access to the SMTP and HTTP interfaces of Mailpit to local or authorized developers.\n- Enforce local binding (127.0.0.1) for testing environments to prevent remote network access.\n\n**Remediation Steps:**\n1. Upgrade Mailpit to version v1.30.4 or higher.\n2. Configure automated container restart policies for recovery in case of resource exhaustion.\n\n## References\n\n- [GitHub Security Advisory GHSA-75mr-qw9x-3r39](https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39)\n- [Patch Commit](https://github.com/axllent/mailpit/commit/6bcb6337838b542d53c348e38c7977f569b6db35)\n- [Mailpit v1.30.4 Release Tag](https://github.com/axllent/mailpit/releases/tag/v1.30.4)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67446)\n- [CVE Org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-67446)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67446) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T07:31:59.621221Z"}]}