EUVD-2026-89361

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-102417

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3 Description A remote authentication bypass via spoofing is possible in the Multi-Record Set Handler component. The issue resides in the opendmarc policy query dmarc function. Recommendations Update to a versio...

CVE-2026-79535: Improper Neutralization of Special Elements used in an OS Command

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-102931

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set syslog of the file /api/ZRnetwork/set syslog. The manipulation of the argument conloglevel/log size results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

PT-2026-108572

Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...

PT-2026-109102

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

PT-2026-109023

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109031

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109052

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109067

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109087

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-102818

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The update config MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where an encoded JWK such as an RSA public key is accepted as a valid HMAC secret without...

Open Redirect

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Open Redirect via the fetchdata method in jwt/jwksclient.py, which follows HTTP redirects when fetching a JWK Set from a remote URI. An attacker who can influence the JWKS endpoint URL or...

AZL-105239 CVE-2026-102266 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.fromjwk is affected because PyJWK verification path used the decoded key without applying preparekey validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As...

PT-2026-102401

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/set passwd endpoint. This occurs when the password1 argument is manipulated, allowing an attacker to execute arbitrary commands on the...

PT-2026-108333

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

PT-2026-108331

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...