Savannah vulnerabilities

Products

• savane 3
• lwIP SMTP client 1

Latest Savannah CVEs

Newest publication first

1. CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow

   Published 2026-10-09

   Critical·CVSS 9.3 EPSS 0.37%

   lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

2. CVE-2024-27632 An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

   Published 2024-04-08

   High·CVSS 8.8 EPSS 1.3%

   An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

3. CVE-2024-27631 Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

   Published 2024-04-08

   Medium·CVSS 6.0 EPSS 0.42%

   Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

4. CVE-2024-27630 Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.

   Published 2024-04-08

   High·CVSS 7.5 EPSS 0.82%

   Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.