https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T10:29:30.078518+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-84697 CVE-2026-84697 — Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix 2026-09-29T10:29:30.093277+00:00

Affected: axllent mailpit

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.