CVE-2026-107587 | Medium | 5.9 | 2026-10-08 | Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-enc… |
CVE-2026-107584 | High | 7.4 | 2026-10-08 | Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver t… |
CVE-2026-107583 | Medium | 6.5 | 2026-10-08 | Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthent… |
CVE-2026-107582 | Medium | 6.5 | 2026-10-08 | Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer… |
CVE-2026-107581 | Medium | 6.5 | 2026-10-08 | Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the… |
CVE-2026-107580 | Medium | 6.5 | 2026-10-08 | Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticate… |
CVE-2026-107579 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated atta… |
CVE-2026-107578 | Medium | 6.7 | 2026-10-08 | Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6… |
CVE-2026-107577 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5… |
CVE-2026-107576 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unau… |
CVE-2026-107575 | Medium | 5.3 | 2026-10-08 | Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to cons… |
CVE-2026-107574 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unava… |
CVE-2026-107573 | High | 7.8 | 2026-10-08 | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail s… |
CVE-2026-107572 | Medium | 6.5 | 2026-10-08 | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the… |
CVE-2026-104704 | High | 7.4 | 2026-10-08 | Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records conta… |
CVE-2026-104660 | High | 7.8 | 2026-10-08 | Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer cred… |
CVE-2026-104659 | High | 7.5 | 2026-10-08 | Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through… |
CVE-2026-104658 | High | 7.8 | 2026-10-08 | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivil… |
CVE-2026-103649 | High | 7.5 | 2026-10-08 | Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely a… |
CVE-2026-103647 | High | 8.0 | 2026-10-08 | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to r… |
CVE-2026-103011 | Medium | 6.5 | 2026-10-08 | Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6… |
CVE-2026-103010 | High | 7.8 | 2026-10-08 | Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3… |
CVE-2026-100741 | Critical | 9.8 | 2026-09-27 | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthe… |