Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107587 | medium | 5.9 | No | Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker... | 2026-10-08 |
| CVE-2026-107584 | high | 7.4 | No | Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validatin... | 2026-10-08 |
| CVE-2026-107583 | medium | 6.5 | No | Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows... | 2026-10-08 |
| CVE-2026-107582 | medium | 6.5 | No | Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive... | 2026-10-08 |
| CVE-2026-107581 | medium | 6.5 | No | Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command'... | 2026-10-08 |
| CVE-2026-107580 | medium | 6.5 | No | Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a re... | 2026-10-08 |
| CVE-2026-107579 | high | 7.5 | No | Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote u... | 2026-10-08 |
| CVE-2026-107578 | medium | 6.7 | No | Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive... | 2026-10-08 |
| CVE-2026-107577 | high | 7.5 | No | Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6... | 2026-10-08 |
| CVE-2026-107576 | high | 7.5 | No | Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 a... | 2026-10-08 |
| CVE-2026-107575 | medium | 5.3 | No | Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticat... | 2026-10-08 |
| CVE-2026-107574 | high | 7.5 | No | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the... | 2026-10-08 |
| CVE-2026-107573 | high | 7.8 | No | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user... | 2026-10-08 |
| CVE-2026-107572 | medium | 6.5 | No | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account... | 2026-10-08 |
| CVE-2026-104704 | high | 7.4 | No | Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated... | 2026-10-08 |
| CVE-2026-104660 | high | 7.8 | No | Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with... | 2026-10-08 |
| CVE-2026-104659 | high | 7.5 | No | Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailSe... | 2026-10-08 |
| CVE-2026-104658 | high | 7.8 | No | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file writ... | 2026-10-08 |
| CVE-2026-103649 | high | 7.5 | No | Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server thr... | 2026-10-08 |
| CVE-2026-103647 | high | 8.0 | No | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an enc... | 2026-10-08 |