github.com/axllent/mailpit (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/axllent/mailpit, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2026-22689 — CVSS 6.5 (medium): Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept…
• CVE-2026-21859 — CVSS 5.8 (medium): Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability…
• CVE-2026-23845 — CVSS 5.8 (medium): Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via…
• CVE-2026-27808 — CVSS 5.8 (medium): Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is…
• CVE-2026-23829 — CVSS 5.3 (medium): Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection…