GHSA-HC5V-GXVJ-58WH PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

GHSA-XXGV-VGVJ-QVXH PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Platform members can rewrite shared labels and owner issue labels without owner/admin authorization Summary praisonai-platform lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to...

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Platform members can rewrite shared labels and owner issue labels without owner/admin authorization Summary praisonai-platform lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to...

CloudRecon

CloudRecon 인증서에서 자산을 찾으세요! 웹을 스캔하세요! @DEFCON 31에서 발표된 도구 제작자 Gunnar Andrews @G0LDENinfosec Jason Haddix @Jhaddix 설치 CloudRecon을 실행하려면 CGO가 활성화되어 있어야 하며 gcc를 설치해야 할 수도 있습니다 sudo apt install gcc go install github.com/g0ldencybersec/CloudRecon@latest 참고: 설치 전에 GOPATH를 설정하는 것을 잊지 마세요. 설명 CloudRecon...

CVE-2026-107724

The fast-jwt library (version 6.2.4 ) contains a vulnerability where raw serialized public JWK or JWKS JSON can be incorrectly classified as an HMAC secret . The root cause is located in src/crypto.js within the performDetectPublicKeyAlgorithms function, which treats non-PEM strings as symmetric ...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

EUVD-2026-95312

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107724

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

maskprocessor

maskprocessor High-Performance word generator with a per-position configurable charset Mask attack Try all combinations from a given keyspace just like in Brute-Force attack, but more specific. Advantage over Brute-Force The reason for doing this and not to stick to the traditional Brute-Force is...

Shelly

Shelly | Python ベースのシンプルなバックドアマネージャー weevely ベース Shelly は Python で書かれたシンプルなツールで、ウェブサイトをリモート操作するためのものです。 インストール : $ git clone https://github.com/tegal1337/Shelly $ cd Shelly $ python3 shell.py 必要条件 : sudo pip install -r requirements.txt 例 : python3 shell.py -g wp-log -p tegal1337 / / / / / \ / / -...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-19032 and CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

CVE-2026-107722

The fast-jwt library (versions 6.2.0 to 6.3.0 ) is vulnerable to RSA→HS256 algorithm confusion due to an incomplete patch of CVE-2026-34950. The root cause resides in src/crypto.js, where performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored. This allows...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

EUVD-2026-95347

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

inhale

Inhale - Malware Inhaler Inhale is a malware analysis and classification tool that is capable of automating and scaling many static analysis operations. This is the beta release version, for testing purposes, feedback, and community development. Background Inhale started as a series of small...