CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

UBUNTU-CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

PT-2026-107902

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

PT-2026-108624

Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...

Secure Quantum Handshakes: Quantum Network Verification Via Simon's Algorithm

Quantum networking represents the future of secure communication, enabling fundamentally new capabilities through quantum information exchange. However, these networks require secure, high-fidelity quantum communication channels, and they require every participating node to be a genuine quantum...

PT-2026-108253

Name of the Vulnerable Software and Affected Versions fast-jwt version 6.2.4 Description An issue exists where raw serialized public JSON Web Key JWK or JSON Web Key Set JWKS JSON is incorrectly classified as an HMAC secret. This occurs because the performDetectPublicKeyAlgorithms function in...

PT-2026-108625

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3960)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...

PT-2026-108655

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

PT-2026-108676

Summary Several remote-content download paths in Pydantic AI buffered the entire HTTP response body into memory before enforcing any size limit. An application that exposes the local web-fetch tool web fetch tool, or the WebFetch capability's local fallback to untrusted prompts can be driven to...

PT-2026-108715

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PT-2026-108634

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

PT-2026-108669

Summary PraisonAI's web crawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by is safe crawl url, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not...

Provable Subexponential Algorithms for NIST Third-Round Lattice Families

We give provable classical subexponential algorithms for secret recovery in growing parameter families associated with NIST third-round lattice candidates. For the Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, and Dilithium/ML-DSA families studied here, polynomial moduli and polylogarithmic...

PT-2026-108709

Summary SkillTools.run skill script accepts a script path parameter and executes it via subprocess.run without any path containment validation. While FileTools has validate path with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any...

PT-2026-108711

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PT-2026-108710

Summary PraisonAI's web crawl agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by is safe crawl url, which resolves the hostname and rejects private/loopback/link-local IPs at validation time. The validated value is the URL string not...

Linux Distros Unpatched Vulnerability : CVE-2026-84790

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - openvpn - None CVE-2026-84790 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3931)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Linux Distros Unpatched Vulnerability : CVE-2026-107314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six...