[ Vendor · 42 CVEs ]
Progressive Robot Ltd
CVEs affecting Progressive Robot Ltd published in the last 30 days, plus any Progressive Robot Ltd CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114477 | 21 Oct 2026 | CVSS 4.3 | Progressive Robot Ltd hMailServerMissing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose… | |
| CVE-2026-114478 | 21 Oct 2026 | CVSS 5.9 | Progressive Robot Ltd hMailServerInsufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote… | |
| CVE-2026-114479 | 21 Oct 2026 | CVSS 5.8 | Progressive Robot Ltd hMailServerNot failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote… | |
| CVE-2026-114489 | 21 Oct 2026 | CVSS 8.1 | Progressive Robot Ltd hMailServerMissing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user… | |
| CVE-2026-114490 | 21 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerIncorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin… | |
| CVE-2026-114470 | 21 Oct 2026 | CVSS 5.3 | Progressive Robot Ltd hMailServerCross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated… | |
| CVE-2026-114471 | 21 Oct 2026 | CVSS 4.7 | Progressive Robot Ltd hMailServerInsertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who… | |
| CVE-2026-114472 | 21 Oct 2026 | CVSS 3.7 | Progressive Robot Ltd hMailServerInsufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote… | |
| CVE-2026-114473 | 21 Oct 2026 | CVSS 5.0 | Progressive Robot Ltd hMailServerIncorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay… | |
| CVE-2026-114474 | 21 Oct 2026 | CVSS 5.9 | Progressive Robot Ltd hMailServerUse of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a… | |
| CVE-2026-114475 | 21 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerMissing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user… | |
| CVE-2026-114476 | 21 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerIncorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose… | |
| CVE-2026-107566 | 19 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerMissing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of… | |
| CVE-2026-107567 | 19 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerUse of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to… | |
| CVE-2026-107568 | 19 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerMissing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot… | |
| CVE-2026-107569 | 19 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerUnchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server… | |
| CVE-2026-107571 | 19 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerIncorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run… | |
| CVE-2026-107585 | 8 Oct 2026 | CVSS 5.3 | Progressive Robot Ltd hMailServerUncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated… | |
| CVE-2026-107586 | 8 Oct 2026 | CVSS 4.3 | Progressive Robot Ltd hMailServerUncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote… | |
| CVE-2026-107580 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote… | |
| CVE-2026-107581 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length… | |
| CVE-2026-107582 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot… | |
| CVE-2026-107583 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote… | |
| CVE-2026-107584 | 8 Oct 2026 | CVSS 7.4 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC… | |
| CVE-2026-107587 | 8 Oct 2026 | CVSS 5.9 | Progressive Robot Ltd hMailServerImproper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have… | |
| CVE-2026-107573 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerIncorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read… | |
| CVE-2026-107574 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail… | |
| CVE-2026-107575 | 8 Oct 2026 | CVSS 5.3 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated… | |
| CVE-2026-107576 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a… | |
| CVE-2026-107577 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0… | |
| CVE-2026-107578 | 8 Oct 2026 | CVSS 6.7 | Progressive Robot Ltd hMailServerImproper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot… | |
| CVE-2026-107579 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerInefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote… | |
| CVE-2026-107572 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerInefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to… | |
| CVE-2026-104659 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerMissing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer… | |
| CVE-2026-104660 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerMissing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no… | |
| CVE-2026-104704 | 8 Oct 2026 | CVSS 7.4 | Progressive Robot Ltd hMailServerProgressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA… | |
| CVE-2026-103649 | 8 Oct 2026 | CVSS 7.5 | Progressive Robot Ltd hMailServerMissing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads… | |
| CVE-2026-104658 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerThe Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by… | |
| CVE-2026-103010 | 8 Oct 2026 | CVSS 7.8 | Progressive Robot Ltd hMailServerHeap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0… | |
| CVE-2026-103011 | 8 Oct 2026 | CVSS 6.5 | Progressive Robot Ltd hMailServerHeap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot… | |
| CVE-2026-103647 | 8 Oct 2026 | CVSS 8.0 | Progressive Robot Ltd hMailServerCross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted… | |
| CVE-2026-100741 | 27 Sep 2026 | CVSS 9.8 | Progressive Robot Ltd hMailServerEval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a… |