CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

UBUNTU-CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554

Summary: CVE-2026-15554 affects the Undertow AJP listener, where forged ssl_cert and is_ssl AJP attributes can be accepted without shared-secret authentication. An unauthenticated attacker with direct TCP access to port 8009 can bypass CLIENT-CERT authentication by injecting a forged X.509 certif...

EUVD-2026-55981

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

PT-2026-70838

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

PT-2026-70088

Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description The Undertow AJP listener accepts forged ssl cert and is ssl AJP attributes without requiring shared-secret authentication. This allows an unauthenticated attacker with direct TCP access to...

CERTFR-2026-ACT-034

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:51+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3msq6wlexks2z 2026-08-10 13:20:52+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117071416518732349...

CVE-2026-71393

creationtimestamp| type| source ---|---|--- 2026-08-10 12:45:30+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-71391...

CVE-2026-19346

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may b...

CVE-2026-19174

creationtimestamp| type| source ---|---|--- 2026-08-07 04:48:36+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:40+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19169

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:29+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19168

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:52+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:27+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19165

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:15+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-07 17:12:24+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117055340138145623 2026-08-13 09:47:20+00:00| seen|...

CVE-2026-19160

creationtimestamp| type| source ---|---|--- 2026-08-07 04:46:33+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:08+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19157

creationtimestamp| type| source ---|---|--- 2026-08-07 04:46:26+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-07 14:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msirtwdgl727 2026-08-13 09:47:01+00:00| seen|...