Latest high and critical flaws
- CVE-2026-114490 Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with High 7.8 · Oct 21, 2026
- CVE-2026-114489 Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credHigh 8.1 · Oct 21, 2026
- CVE-2026-114476 Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential High 7.5 · Oct 21, 2026
- CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the High 7.8 · Oct 19, 2026
- CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mHigh 7.5 · Oct 19, 2026
- CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail theyHigh 7.5 · Oct 19, 2026
- CVE-2026-107584 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery.High 7.4 · Oct 8, 2026
- CVE-2026-107579 Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacHigh 7.5 · Oct 8, 2026
- CVE-2026-107577 Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 aHigh 7.5 · Oct 8, 2026
- CVE-2026-107576 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unautHigh 7.5 · Oct 8, 2026
- CVE-2026-107574 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavaiHigh 7.5 · Oct 8, 2026
- CVE-2026-107573 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail seHigh 7.8 · Oct 8, 2026
- CVE-2026-104704 Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contaiHigh 7.4 · Oct 8, 2026
- CVE-2026-104660 Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credeHigh 7.8 · Oct 8, 2026
- CVE-2026-104659 Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6High 7.5 · Oct 8, 2026
- CVE-2026-104658 The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileHigh 7.8 · Oct 8, 2026
- CVE-2026-103649 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely anHigh 7.5 · Oct 8, 2026
- CVE-2026-103647 Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to ruHigh 8 · Oct 8, 2026
- CVE-2026-103010 Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3High 7.8 · Oct 8, 2026
- CVE-2026-100741 Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenCritical 9.8 · Sep 27, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.