CVE-2026-13073

The CVE describes an issue in MongoDB’s mongod where an authenticated user with read-only privileges can trigger abnormal termination via a crafted aggregation command. The root cause is an internal engine selection inconsistency caused by a specific combination of aggregation options, leading to...

EUVD-2026-47788

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

A Covert Precision Satellite Communication Framework Assisted by Cooperative IRSs

Satellite communication SatCom, as an effective complement to terrestrial networks, has attracted considerable attention from both academia and industry owing to its wide coverage and high flexibility. However, the inherent openness of satellite links renders them highly vulnerable to...

CVE-2026-13073: Reachable Assertion

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

PT-2026-63477

Name of the Vulnerable Software and Affected Versions mongod affected versions not specified Description An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command. This leads to a denial of service for all connect...

Stegano 3.0.0

Stegano is a basic Python Steganography module. Stegano implements two methods of hiding: using the red portion of a pixel to hide ASCII messages, and using the Least Significant Bit LSB technique. It is possible to use a more advanced LSB method based on integers sets. The sets Sieve of...

CVE-2026-63968

In CVE-2026-63968, the Linux kernel fixes an infinite loop in IPv6 path selection (fib6_select_path). The advisory notes that writers holding tb6_lock could list_del_rcu(&first->fib6_siblings) without waiting for RCU readers, causing first->fib6_siblings.next to reference the old ring and a...

How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions

Jailbreak attacks on large language models are usually evaluated by attacker-centric metrics such as attack success rate ASR, yet an attack that breaks a model is not necessarily useful for improving its safety. We propose a defender-centric view of jailbreak evaluation, where attacks are evaluat...

Cross-site Scripting (XSS)

FacturaScripts is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user-controlled referencia and codsubcuenta values in JavaScript within HTML onclick attributes, which allows an attacker to inject and execute arbitrary JavaScript when a user opens the...

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44968

Summary: CVE-2026-44968 affects dbt-mcp (Model Context Protocol server). Prior to v1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended user-supplied MCP parameters to the dbt subprocess argv without validation. This enables argument-list injection via two vectors: (1) node_selecti...

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Reusable skills are becoming a fundamental building block of Large Language Model LLM agents, enabling capabilities to be packaged, shared, and reused across diverse applications. However, existing security research primarily focuses on prompt injection and runtime execution, leaving security ris...

CVE-2026-6790: Improper Input Validation

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summaryrundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independent...

PYSEC-2026-2444 dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...

Noise Resilience of Quantum Key Distribution Protocols Secured against Independent Attacks with One-Way Communication

We investigate the resilience to noise of single-qubit quantum key distribution QKD protocols in the scenario of security against independent eavesdropping attacks and key distillation based on one-way classical communication. To this end, we introduce a noise-based metric that quantifies the...

PT-2026-59114

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary run dbt command in src/dbt mcp/dbt cli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two...