Linux Distros Unpatched Vulnerability : CVE-2026-107314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3931)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

CVE-2026-107724: Improper Verification of Cryptographic Signature

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-4021)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare loca...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3894)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...

PT-2026-107902

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

PT-2026-108624

Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array. The two loops disagreed: any non-array ring carrying a numeric length a...

CVE-2026-107579: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...

PT-2026-117203

Summary Coraza extracts a multipart file upload's filename using Go's standard-library mime.ParseMediaType, which only decodes the RFC 5987/6266 extended filename Content-Disposition parameter when its declared charset is exactly us-ascii or utf-8. Any other charset — including iso-8859-1, which...

Apache Avatica 1.29.0 JDBC Connection Property Injection

Summary Avatica is a framework for building database drivers. Avatica is defined by a wire API between a client and a server. The Avatica server is an HTTP server, the Avatica client is a JDBC driver, and the wire API is defined by JSON or Protobuf Buffers. The flexibility of the wire API and HTT...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3960)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...

PT-2026-108251

Name of the Vulnerable Software and Affected Versions fast-jwt versions 6.2.0 through 6.2.x Description fast-jwt can misclassify an RSA public key as an HMAC secret if the key contains non-whitespace content such as control characters, zero-width characters, comments, or wrapper text before its P...

PT-2026-108687

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

PT-2026-108649

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequest headers= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponse follow meta refresh fetched the refresh target with no notion of a crossed origin, so...

Mechanize sends credential headers to another origin after a meta refresh

Summary mechanize applied no trust boundary to a meta refresh, so credentials set through Mechanizerequestheaders= followed a refresh that pointed at another origin. Details Mechanize::HTTP::Agentresponsefollowmetarefresh fetched the refresh target with no notion of a crossed origin, so...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3997)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-3955)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare loca...

EulerOS 2.0 SP15 : docker-runc (EulerOS-SA-2026-3907)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : 'This is a PUBLIC release of a low-severity vulnerability in runc which\nhas been fixed in runc 1.3.6, runc 1.4.3, and runc 1.5.0-rc.3. There...

EulerOS 2.0 SP15 : docker-runc (EulerOS-SA-2026-3973)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : 'This is a PUBLIC release of a low-severity vulnerability in runc which\nhas been fixed in runc 1.3.6, runc 1.4.3, and runc 1.5.0-rc.3. There...

PT-2026-107890

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...