CVE-2026-43964Low· 3.7▾ SunlitPostfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.9%
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
postfix < 3.8.16postfix >= 3.9.0, < 3.9.10postfix >= 3.10.0, < 3.10.9Upgrade past the affected range:
postfix 3.10.9Connected by shared product, vendor, weakness, or advisory.
CVE-2023-51764Medium· 5.3Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions)
CVE-2026-116735Medium· 6.1libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
CVE-2026-115916Medium· 6.5vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
CVE-2026-114460Medium· 5.3Mod_qos: query truncation during json body merging permits security-rule bypass
CVE-2026-12727Medium· 4.3IBM MQ Buffer Overflow
CVE-2026-111273Medium· 6.1unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API