Progressive Robot Ltd Hmailserver
60 CVEs affecting Progressive Robot Ltd Hmailserver. Latest disclosed: 2026-11-11. Critical: 1, High: 30.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100741 | Critical | 9.8 | 2026-09-27 | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthe… |
CVE-2026-126617 | High | 8.8 | 2026-11-11 | SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote… |
CVE-2026-114489 | High | 8.1 | 2026-10-21 | Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose cre… |
CVE-2026-103647 | High | 8.0 | 2026-10-08 | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to r… |
CVE-2026-126612 | High | 7.8 | 2026-11-11 | Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mai… |
CVE-2026-126607 | High | 7.8 | 2026-11-11 | Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authent… |
CVE-2026-114490 | High | 7.8 | 2026-10-21 | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with… |
CVE-2026-107571 | High | 7.8 | 2026-10-19 | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the… |
CVE-2026-107573 | High | 7.8 | 2026-10-08 | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail s… |
CVE-2026-104660 | High | 7.8 | 2026-10-08 | Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer cred… |
CVE-2026-104658 | High | 7.8 | 2026-10-08 | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivil… |
CVE-2026-103010 | High | 7.8 | 2026-10-08 | Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3… |
CVE-2026-126623 | High | 7.5 | 2026-11-11 | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail deliv… |
CVE-2026-126621 | High | 7.5 | 2026-11-11 | Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private key… |
CVE-2026-126613 | High | 7.5 | 2026-11-11 | Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's… |
CVE-2026-126609 | High | 7.5 | 2026-11-11 | Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a ro… |
CVE-2026-114476 | High | 7.5 | 2026-10-21 | Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential… |
CVE-2026-107569 | High | 7.5 | 2026-10-19 | Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying… |
CVE-2026-107567 | High | 7.5 | 2026-10-19 | Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail the… |
CVE-2026-107579 | High | 7.5 | 2026-10-08 | Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated atta… |