Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨*CVE* CVE-2026-45709 Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), sh… https://www.cve.org/CVERecord?id=CVE-2026-45709 ----- Traducción: CVE-2026-45709 Mai… http://infoflow.cloud`
Post summary
The post lists CVE-2026-45709 with a link to its CVE record but lacks specific actionable or technical details.
CVE-2026-45709 Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), sh… https://www.cve.org/CVERecord?id=CVE-2026-45709
Post summary
The tweet announces CVE-2026-45709 for Mailpit and indicates that a fix has been released for a related SSRF issue (CVE-2026-23845).
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axllent | mailpit | - | - | - |