EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

CVE-2026-81868: Authentication Bypass Using an Alternate Path or Channel

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

PT-2026-94384

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate provided in the X-Client-Cert request header without...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

CVE-2026-27564

creationtimestamp| type| source ---|---|--- 2026-09-16 07:56:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/117279648543638927 2026-09-16 07:57:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mvmo3krdbfq2 2026-09-16 07:57:38+00:00| seen|...

CVE-2026-27562

creationtimestamp| type| source ---|---|--- 2026-09-16 07:56:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/117279648543638927 2026-09-16 07:57:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mvmo3krdbfq2 2026-09-16 07:57:38+00:00| seen|...

CVE-2026-27563

creationtimestamp| type| source ---|---|--- 2026-09-16 07:56:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/117279648543638927 2026-09-16 07:57:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mvmo3krdbfq2 2026-09-16 07:57:38+00:00| seen|...

CLEANSTART-2026-TO35695 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

EUVD-2026-78773

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-86879

creationtimestamp| type| source ---|---|--- 2026-09-15 05:16:04+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260915 2026-09-15 21:16:33+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:00:56+00:00|...

PT-2026-97298

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M14 through 11.0.25 Apache Tomcat versions 10.1.22 through 10.1.59 Apache Tomcat versions 9.0.92 through 9.0.121 Description CLIENT CERT authentication does not fail as expected in certain scenarios when the soft...

CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

AZL-100995 CVE-2026-84445 affecting package cert-manager for versions less than 1.12.15-14

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

CERTFR-2026-ACT-039

creationtimestamp| type| source ---|---|--- 2026-09-14 14:15:50+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mvicd553l22y 2026-09-14 14:15:59+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/117269813619270733...

Astra Linux – Vulnerability in Tomcat9

There is an improper authentication vulnerability in Apache Tomcat, which means that under certain circumstances e.g., using CLIENT-CERT or SPNEGO, a user can be authenticated even if the user does not exist in the DataSourceRealm. This issue affects Apache Tomcat versions from 11.0.0-M1 through...

CVE-2026-90942: Incorrect Authorization

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-89176

creationtimestamp| type| source ---|---|--- 2026-09-11 08:45:23+00:00| seen| https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html 2026-09-11 09:51:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6n3dhk4jkjj5m 2026-09-11 11:00:49+00:00| seen|...