Astra Linux – Vulnerability in mbedtls

Mbed TLS versions prior to 3.6.4 allow a use-after-free in certain situations of applications developed in accordance with the documentation. The function mbedtlsx509stringtonames takes a head argument, which is documented as an output argument. The documentation does not indicate that the functi...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: helm-push, kyverno-notation-aws, rancher-helm, kube-arangodb, kargo, k8sgpt, gitness, helm-mapkubeapis, cluster-api-helm-controller, opentofu, xeol, cert-manager-cmctl, flux-helm-controller, helm-set-status, maru, manifest-tool, k9s...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: helm-push, kyverno-notation-aws, rancher-helm, kube-arangodb, kargo, k8sgpt, gitness, helm-mapkubeapis, cluster-api-helm-controller, opentofu, xeol, cert-manager-cmctl, flux-helm-controller, helm-set-status, maru, manifest-tool, k9s...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

PT-2026-105179

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify fun that overrides bad cert, unknown ca / bad cert, selfsigned peer when the presented cert "matches" a whitelisted one. The match key is extract...

AlmaLinux 9.2 [TuxCare] Security Update: libreswan (ALMALINUX9.2:CLSA-2026:1785422092)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785422092 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2024_1751)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241751 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuratio...

Rocky Linux 8 [CIQ] Security Update: python3-requests (crlsa-2025_0012)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20250012 advisory. requests: subsequent requests to the same host ignore cert verification CVE-2024-35195 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 9 [CIQ] Security Update: python3-requests / python3-requests+security / etc (crlsa-2025_7049)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257049 advisory. requests: subsequent requests to the same host ignore cert verification CVE-2024-35195 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-105162

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peer cert issuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. T...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc (CENTOS7:CLSA-2024:1712837808)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1712837808 advisory. - When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle...

CVE-2026-78313

creationtimestamp| type| source ---|---|--- 2026-09-28 17:18:04+00:00| seen| https://t.me/icscert/1442...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...