Savannah lwIP SMTP client

CISA Cybersecurity AdvisoriesPublished 2026-10-09 14:58 UTC

View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-2026-15340) CVSS Vendor Equipment v3 9.8 Savannah lwIP SMTP client 1 Vulnerability Buffer Copy without Checking Size of Input ('Classic Buffer…

— CISA Cybersecurity Advisories

Read at CISA Cybersecurity Advisories

CVE-2026-15340

Severity: 9.3 Critical · CVSS 4.0 · Icscert
Exploited: Not in CISA’s catalog
Published: 2026-10-09

Savannah lwIP SMTP client

Affected: 2.2.1

Fixed: patch_125_smtp_txbuf.diff; git commit (614420f82c8729d070e01464c0dddb3c9525c772)

cisa.gov · github.com · CVE record · NVD

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

The Hacker NewsCybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star…

6 hours ago

Image: BBC News Technology
Three fired OpenAI safety researchers dispute the company’s misconduct claims
Three former OpenAI safety researchers dispute the company’s claim that they mishandled sensitive information, saying they were dismissed for prioritising safety. In an open letter, they warn the firings may have a chilling effect on employees and AI safety culture.
4 hours ago
Image: BleepingComputer
Max severity SonicWall SMA1000 flaw now exploited in attacks
BleepingComputerAttackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago.
12 hours ago