Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107576 | high | 7.5 | No | Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 a... | 2026-10-08 |
| CVE-2026-107575 | medium | 5.3 | No | Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticat... | 2026-10-08 |
| CVE-2026-107574 | high | 7.5 | No | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the... | 2026-10-08 |
| CVE-2026-107573 | high | 7.8 | No | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user... | 2026-10-08 |
| CVE-2026-107572 | medium | 6.5 | No | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account... | 2026-10-08 |
| CVE-2026-104704 | high | 7.4 | No | Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated... | 2026-10-08 |
| CVE-2026-104660 | high | 7.8 | No | Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with... | 2026-10-08 |
| CVE-2026-104659 | high | 7.5 | No | Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailSe... | 2026-10-08 |
| CVE-2026-104658 | high | 7.8 | No | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file writ... | 2026-10-08 |
| CVE-2026-103649 | high | 7.5 | No | Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server thr... | 2026-10-08 |
| CVE-2026-103647 | high | 8.0 | No | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an enc... | 2026-10-08 |
| CVE-2026-103011 | medium | 6.5 | No | Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive R... | 2026-10-08 |
| CVE-2026-103010 | high | 7.8 | No | Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer... | 2026-10-08 |
| CVE-2026-1403 | medium | 6.5 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3... | 2026-10-08 |
| CVE-2026-88257 | not reported | — | No | Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function... | 2026-10-08 |
| CVE-2026-104634 | not reported | — | No | Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null... | 2026-10-08 |
| CVE-2026-93509 | medium | 6.5 | No | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes th... | 2026-10-08 |
| CVE-2026-105190 | medium | 5.3 | No | The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress a... | 2026-10-08 |
| CVE-2026-104671 | medium | 5.3 | No | The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers... | 2026-10-08 |
| CVE-2026-103517 | medium | 5.3 | No | The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes f... | 2026-10-08 |