CVE-2026-107583

Progressive Robot hMailServer versions 6.3.2 through 6.3.5 are vulnerable to an inefficient algorithmic complexity flaw in the webmail's message view of the REST API . A remote unauthenticated attacker can send a message containing an HTML reference to a single small embedded image a very large n...

CVE-2026-107583 Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

EUVD-2026-94862

Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded heade...

CVE-2026-97404

A flaw was found in OpenStack Zaqar. An unauthenticated remote attacker who knows a target project's identifier can bypass authentication by sending an HTTP request containing an empty URL-Signature header to the Web Server Gateway Interface WSGI transport. Successful exploitation allows the...

CVE-2026-85422

A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...

CVE-2026-107799: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

PT-2026-108259

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

PT-2026-108257

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

A Zero-Knowledge Signature Framework for Efficient Post-Quantum Message Authentication in Cooperative Automated Driving

Connected and Automated Vehicles CAV rely on authenticated Vehicle-to-Everything V2X communications to exchange safety-critical information among vehicles and roadside infrastructure. As the automotive industry transitions toward post-quantum cryptography PQC, the significantly larger public keys...

PT-2026-108017

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An arbitrary code execution issue exists due to the ZMQ message decoder unconditionally deserializing PickleWrapper payloads using the pickle.loads function within maybe unwrap pickle without...

PT-2026-108254

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-93034: Deserialization of Untrusted Data

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-107831: Cross-Site Request Forgery (CSRF)

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107583: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

mutt -- Heap out-of-bounds write via crafted Content-Header line

Kevin J. McCarthy reports: Fixing an OOB heap write. This is triggered by a specially crafted Content-Header line in an email that is used as a template for a new email, via . Thanks to Calif.io, in collaboration with Anthropic for sending me a detailed write up and suggested patch...

PT-2026-107907

Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE RFC 7672 to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete no answer, SERVFAIL, a malformed reply, an answer without the requested records and without...

PT-2026-108246

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.5.0 Description The Prompt.chat messages function attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data, attacker-controlled JSON can be interpreted a...

PT-2026-108622

Summary Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettingsinclude content=False to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to...

CVE-2026-107797: Improper Neutralization of Input During Web Page Generation

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

GHSA-H6W7-QMCM-Q6XR RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...