CVE-2023-51764Medium· 5.3▾ TwilightPoC availablePostfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can u…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.6%
4 GitHub repos (last check)
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
postfix < 3.5.23postfix >= 3.6.0, < 3.6.13postfix >= 3.7.0, < 3.7.9postfix >= 3.8.0, < 3.8.4fedora = 38fedora = 39enterprise_linux = 8.0enterprise_linux = 9.0Upgrade past the affected range:
postfix 3.8.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-43964Low· 3.7Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
CVE-2025-31356NoneInsufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure
CVE-2026-105741High· 7.1Langflow is a tool for building and deploying AI-powered agents and workflows
CVE-2026-104056Critical· 9.8Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding
CVE-2026-55174Medium· 5.9UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes
CVE-2026-101278Medium· 4.3A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2