Lucene search
+L

63199 matches found

Tenable Nessus
Tenable Nessus
•added 2026/09/18 12:00 a.m.•11 views

EulerOS 2.0 SP10 : nfs-utils (EulerOS-SA-2026-3754)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

6.5CVSS6.5AI score0.00462EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/09/18 12:00 a.m.•9 views

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109802)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109802 advisory. FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in...

8.7CVSS5.7AI score0.00637EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
•added 2026/09/18 12:00 a.m.•12 views

EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

6.3CVSS6AI score0.00319EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•2 views

CVE-2026-77239: Improper Authorization

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

8.1CVSS5.9AI score0.00525EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•2 views

CVE-2026-10751: Deserialization of Untrusted Data

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...

7.5CVSS6.5AI score0.00369EPSS
SaveExploits0References2
BDU FSTEC
BDU FSTEC
•added 2026/09/18 12:00 a.m.•9 views

The vulnerability of the AMQConnection.java file in the RabbitMQ rabbitmq-java-client Java client allows a attacker to cause a service failure.

The vulnerability of the AMQConnection.java file in the RabbitMQ rabbitmq-java-client Java client lies in its reliance on unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

7.8CVSS6.3AI score0.00552EPSS
SaveExploits0References7Affected Software1
BDU FSTEC
BDU FSTEC
•added 2026/09/18 12:00 a.m.•8 views

The vulnerability of the client for remote desktop clients on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Remote Desktop Client for Windows operating systems in dealing with client remote desktops is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

10CVSS7.6AI score0.00819EPSS
SaveExploits0References2Affected Software16
Tenable Nessus
Tenable Nessus
•added 2026/09/18 12:00 a.m.•13 views

EulerOS Virtualization 2.12.1 : nfs-utils (EulerOS-SA-2026-3600)

According to the versions of the nfs-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client t...

6.5CVSS6.5AI score0.00462EPSS
SaveExploits0References2
BDU FSTEC
BDU FSTEC
•added 2026/09/18 12:00 a.m.•8 views

The vulnerability of the Skype for Business Server’s instant messaging program, related to the possibility of using client-side authentication, allows attackers to carry out spoofing attacks.

The vulnerability of the Skype for Business Server’s instant messaging program relates to the possibility of using client-side authentication. Exploiting this vulnerability could allow attackers to carry out spoofing attacks remotely...

7.5CVSS6.4AI score0.00526EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/09/18 12:00 a.m.•4 views

EulerOS Virtualization 2.11.1 : python-ldap (EulerOS-SA-2026-3461)

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5,...

6.9CVSS6.2AI score0.00458EPSS
SaveExploits2References3
MongoDB
MongoDB
•added 2026/09/17 8:31 p.m.•13 views

libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

6.3CVSS5.8AI score0.00321EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
•added 2026/09/17 8:31 p.m.•13 views

CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

6.3CVSS5.8AI score0.00321EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/17 8:31 p.m.•37 views

CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

6.3CVSS0.00321EPSS
SaveExploits0References1
OSV
OSV
•added 2026/09/17 8:30 p.m.•9 views

GHSA-5MQ7-RWHJ-4FH9 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

6.5CVSS5.8AI score0.0025EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/09/17 8:30 p.m.•12 views

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

6.5CVSS5.8AI score0.0025EPSS
SaveExploits0References5Affected Software1
NVD
NVD
•added 2026/09/17 8:18 p.m.•18 views

CVE-2026-92943

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

9.2CVSS0.00381EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/17 7:14 p.m.•29 views

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

9.2CVSS6AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/09/17 7:14 p.m.•17 views

EUVD-2026-82378

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

9.2CVSS6AI score0.00381EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/17 7:14 p.m.•42 views

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

9.2CVSS0.00381EPSS
SaveExploits0References4
Snyk
Snyk
•added 2026/09/17 5:44 p.m.•8 views

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and...

8.7CVSS5.8AI score0.00361EPSS
SaveExploits0References2
Rows per page
Query Builder