openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-32118

🚀 CVE-2025-32118 - WordPress CMP Plugin RCE Exploit 🔍 Title: WordPress CMP – Coming Soon & Maintenance plugin = 4.1.13 - Remote Code Execution RCE 🗓️ Published: 2025-04-04 🔐 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type 📊 CVSS: 9.1 CRITICAL —...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

CLEANSTART-2026-SF17865 Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response

CVE-2026-75805 affects multiple packages. Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. See references for individual vulnerability details...

CLEANSTART-2026-UH94851 Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`

CVE-2026-63073 affects multiple packages. Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. See references for individual vulnerability details...

CLEANSTART-2026-BP03068 Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid)

CVE-2026-63074 affects multiple packages. Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. See references for individual vulnerability details...

CLEANSTART-2026-MH33423 Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN

CVE-2026-63076 affects multiple packages. Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN. See references for individual vulnerability details...

OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Distinguished Names within CMP messages. The issue results from the lack...

WordPress CMP – Coming Soon & Maintenance plugin 4.1.19-4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Sanjeev Kumar in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.19-4.1.20...

CVE-2026-101138

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active...

CVE-2026-101138 CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active...

CVE-2026-101138 CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active...

CVE-2026-101138

The CMP – Coming Soon & Maintenance WordPress plugin, in versions 4.1.19 through 4.1.20 , is vulnerable to an unauthenticated maintenance mode bypass. The flaw occurs because the plugin fails to correctly apply maintenance mode restrictions to pages included in a whitelist via manually entered UR...

PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

CVE-2026-101973

A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment...

EUVD-2026-101436

A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows an unauthenticated remote attacker to cause a denial of service via a malformed packet received during CMP enrollment or automatic certificate re-enrollment...