CVE-2026-41873

** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet. As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-444

• https://lists.apache.org/thread/1c7jtxjobh280kqc13fzw1cg57xrz951Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/28/17

Published

Apr 28, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41860CWE-326 in BOSH allows a local attacker to steal Basic-auth …8.8
• CVE-2026-41861Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metad…4.2
• CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, …8.8
• CVE-2026-41863Spring AI's support for Anthropic's Skills API used LLM-infl…6.5
• CVE-2026-4187A vulnerability was identified in Tiandy Easy7 Integrated Ma…5.5
• CVE-2026-41872"Kura Sushi Official App" provided by EPG, Inc. is vulnerabl…9.1
• CVE-2026-41874Quick.Cart stores hard-coded, plaintext admin credentials in…6.8
• CVE-2026-41876R-SOFT DMS is vulnerable to OS Command Injection in konwertu…8.7
• CVE-2026-41877R-SOFT DMS is vulnerable to Stored XSS in file upload functi…5.1
• CVE-2026-41878R-SOFT DMS is vulnerable to Insecure Direct Object Reference…7.1
• CVE-2026-41879R-SOFT DMS stores superadmin credentials using a non-salted …8.2
• CVE-2026-4188A security flaw has been discovered in D-Link DIR-619L 2.06B…8.8