Spoofy

Spoofy WHAT Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records. You may be asking, "Why do we need another tool that can check if a domain can be spoofed?" Well, Spoofy is different and here is why: 1. Custom, manually tested spoof logic No guessing...

EUVD-2026-101754

Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing...

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^ \t/ against the growing merged line on every iteration...

npm: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

npm: Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.9...

CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-

CVE-2026-8080 – DKIM Signature Verification Bypass Header Canonicalization Flaw Program Code Python email parsing simulation dkimverifiersim.py - Flawed DKIM verifier import re, hashlib Simulated email with DKIM signature rawemail = b"""From: [email protected] To: [email protected]...

CVE-2026-107566

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107567

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...

CVE-2026-107568

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107566 Missing Authorization in hMailServer

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

EUVD-2026-104408

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107566

Progressive Robot hMailServer versions 6.2.22 through 6.3.6 are vulnerable to a missing authorization flaw in the Sieve editheader action and the mail-rule Set header value action (v6.0.0 through 6.3.6). This allows an authenticated user to manipulate headers such as From , Sender , and DKIM-Sign...

CVE-2026-107566 Missing Authorization in hMailServer

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107568

Progressive Robot hMailServer versions 6.2.22 through 6.3.6 are vulnerable to a missing authorization flaw in the Sieve notify action and the mail-rule Reply action. An authenticated user can craft a script or rule to send mail from any address because the server fails to verify if the specified ...

CVE-2026-107568 Missing Authorization in hMailServer

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

EUVD-2026-104407

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107568 Missing Authorization in hMailServer

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107567

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Use of Less Trusted Source (CWE-348) issue in the DKIM signing process. A remote unauthenticated attacker can send inbound mail with a forged From header belonging to a hosted domain. If DKIM signing is enabled, the se...

CVE-2026-107567 Use of Less Trusted Source in hMailServer

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...

EUVD-2026-104406

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...

CVE-2026-107567 Use of Less Trusted Source in hMailServer

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...