CVE-2026-73570 command injection in Zimbra yields remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
Stories per day · 30 days
2 RSS
12 stories, newest first · one card per story
Stories tagged #smtp
Cisco Snort 3 SMTP MIME flaw can restart the detection engine
An unauthenticated attacker can send crafted SMTP packets that make Snort 3 restart; Cisco has updates and no workarounds.
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Apache log4net CVE-2026-105241 lets unencodable Unicode discard an entire SmtpPickupDirAppender email batch.
SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mail
SEC Consult disclosed sender spoofing in Apple iCloud Mail SMTP; Apple fixed it, with no CVE assigned.
Savannah lwIP SMTP client
CISA reports a critical buffer overflow in Savannah lwIP SMTP client 2.2.1 that may allow remote code execution.
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Rapid7 documents stealthy Linux backdoors—BPFDoor, Rekoobe, and new AVERAT implant—targeting telecom and network-edge appliances in South Korea and Taiwan.
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale
SOCRadar flagged alleged French leaks, an SMTP dump, a US access auction, and a Struts exploit sale.
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
SEC Consult showed header smuggling can spoof arbitrary sender addresses on Apple iCloud.
.png&w=828&q=75)
SMTP is the key: BPFDoor and AVERAT hitting the network edge
Rapid7 details BPFDoor and AVERAT Linux implants disguised as telecom-edge software in South Korea and Taiwan.
Free iCloud Account Could Let Attackers Spoof Any @icloud.com Address and Pass Email Security Checks
Two patched Apple iCloud SMTP parsing flaws let free accounts spoof any @icloud.com address while passing SPF, DKIM, and DMARC checks.
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
TIKTOUK harvests exposed WordPress files and JavaScript to steal SMTP, AWS, and API credentials.
Exim Mail Server 4.100.1 Fixes 4 Security Flaws Including SMTP Smuggling and Heap Corruption
Exim 4.100.1 patches four flaws, including high-severity Proxy Protocol heap corruption, uninitialized data leak, GnuTLS use-after-free, and SMTP smuggling.