https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 13:50:12 +0000 https://db.gcve.eu/vuln/cve-2026-107587 <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker&#39;s key. When its recipient opened a signed message, the webmail kept the signer&#39;s certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message&#39;s From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate&#39;s key who obtains a copy of such a message can read it.</p> <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker&#39;s key. When its recipient opened a signed message, the webmail kept the signer&#39;s certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message&#39;s From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate&#39;s key who obtains a copy of such a message can read it.</p> https://db.gcve.eu/vuln/cve-2026-107587