EUVD-2026-102922

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails...

CVE-2026-86009 Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails...

CVE-2026-86009 Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails...

PT-2026-115659

Name of the Vulnerable Software and Affected Versions Mailu versions prior to f05aeb8322e2f61096af6b089d61ba6f40587d96 Description Domain managers can enable spoofing for hosted domains they do not control. This allows a malicious domain administrator to send emails authenticated with DKIM...

CVE-2026-86009: Improper Authorization

Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails...

Mailu authorization issue vulnerability

Mailu has an authorization issue vulnerability. This vulnerability arises from the ability of domain administrators to enable deception for uncontrolled managed domains, allowing them to send domain emails that are authenticated via DKIM/SPF, even though these emails should not be sent...

Astra Linux – vulnerability in libspf2

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability enables network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. No authentication is required to exploit this vulnerability. The specific flaw lies in the parsing of SPF...

espoofer

espoofer espoofer es una herramienta de prueba de código abierto para eludir la autenticación SPF, DKIM y DMARC en sistemas de correo electrónico. Ayuda a administradores de servidores de correo y probadores de penetración a verificar si el servidor de correo y el cliente objetivo son vulnerables...

subjack

subjack Escáner de Toma de Control DNS Subjack es un escáner de toma de control DNS escrito en Go, diseñado para escanear una lista de dominios de forma concurrente e identificar aquellos que pueden ser secuestrados. Gracias a la velocidad y eficiencia de Go, esta herramienta destaca especialment...

CVE-2026-107575

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to an inefficient algorithmic complexity flaw in the SPF macro expansion. A remote unauthenticated attacker can consume worker-thread time by publishing a crafted SPF record where the domain-spec expands via macros to a name ex...

EUVD-2026-94857

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

PT-2026-107898

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-107575: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...

CVE-2026-33586

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...

CVE-2026-33586 Authenticated SMTP Sender Address Forgery

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...