CVE Vulnerability Database
Search and browse 425,002 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107577 | HIGH | 7.5 | — | Oct 8, 2026 | Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive... |
| CVE-2026-107576 | HIGH | 7.5 | — | Oct 8, 2026 | Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6... |
| CVE-2026-107575 | MEDIUM | 5.3 | — | Oct 8, 2026 | Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a ... |
| CVE-2026-107574 | HIGH | 7.5 | — | Oct 8, 2026 | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated a... |
| CVE-2026-107573 | HIGH | 7.8 | — | Oct 8, 2026 | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a loca... |
| CVE-2026-107572 | MEDIUM | 6.5 | — | Oct 8, 2026 | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an au... |
| CVE-2026-107570 | LOW | 2.5 | 0.1% | Oct 8, 2026 | heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is us... |
| CVE-2026-107275 | MEDIUM | 6.8 | — | Oct 8, 2026 | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to ... |
| CVE-2026-93509 | MEDIUM | 6.5 | — | Oct 8, 2026 | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is posit... |
| CVE-2026-105190 | MEDIUM | 5.3 | — | Oct 8, 2026 | The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before cr... |
| CVE-2026-104704 | HIGH | 7.4 | — | Oct 8, 2026 | Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger wh... |
| CVE-2026-104671 | MEDIUM | 5.3 | — | Oct 8, 2026 | The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX r... |
| CVE-2026-104660 | HIGH | 7.8 | — | Oct 8, 2026 | Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local in... |
| CVE-2026-104659 | HIGH | 7.5 | — | Oct 8, 2026 | Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progr... |
| CVE-2026-104658 | HIGH | 7.8 | — | Oct 8, 2026 | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on... |
| CVE-2026-103649 | HIGH | 7.5 | — | Oct 8, 2026 | Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacke... |
| CVE-2026-103647 | HIGH | 8 | — | Oct 8, 2026 | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who ca... |
| CVE-2026-103517 | MEDIUM | 5.3 | — | Oct 8, 2026 | The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notificati... |
| CVE-2026-103011 | MEDIUM | 6.5 | — | Oct 8, 2026 | Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToStri... |
| CVE-2026-103010 | HIGH | 7.8 | — | Oct 8, 2026 | Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressi... |
| CVE-2026-107510 | CRITICAL | 9.1 | — | Oct 8, 2026 | An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation. |
| CVE-2026-107503 | HIGH | 7.1 | 0.2% | Oct 8, 2026 | In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment confi... |
| CVE-2026-89191 | MEDIUM | 6.8 | 0.2% | Oct 8, 2026 | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attr... |
| CVE-2026-71896 | MEDIUM | 6.5 | 0.2% | Oct 8, 2026 | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account in... |
| CVE-2026-71895 | HIGH | 7.1 | 0.2% | Oct 8, 2026 | An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes co... |