CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and...

Improper Resource Shutdown or Release

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to NettyConnectListener.onSuccess in the Netty connect path. An attacker can exhaust maxConnections...

resterm v1.8.1

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is an API client that uses .http/.rest files as source code. Almost all the features live in .http files, so they are easy to review in Git or any other version control. You can send requests, test API flows, record HTT...

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.11.0 and more Source cves: CVE-2026-85717 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963951...

be.wegenenverkeer:rxhttpclient (2.0.1), be.wegenenverkeer:rxhttpclient-fs2_2.13 (2.0.1) +103 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=2.14.5, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.14.5, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =3.0.18.0, =4.0.11.0 and more Source cves: CVE-2026-85717 Source advisory: GHSA-F8M2-889X-VW4X...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.22.1 and more Source cves: CVE-2026-85717 Source advisory: GHSA-F8M2-889X-VW4X...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.4-rc1, <=6.0.5), com.cloudbees.thirdparty:zendesk-java-client (>=1.5.0, <=1.6.1) +43 more potentially affected by CVE-2026-85717 via org.asynchttpclient:async-http-client (>=3.0.9, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.9, =6.0.4-rc1, =1.5.0, =5.0.0, =5.0.0, =1.17.15, =1.17.15, =1.17.15, =252.1.0, =11.2.1, =2.0.0, =4.20.0, =4.20.0, =4.22.1 and more Source cves: CVE-2026-85717 Source advisory: OSV:GHSA-F8M2-889X-VW4X...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through ChannelManager.newHttpContentDecompressor in...

Detection of Error Condition Without Action

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Detection of Error Condition Without Action via the SCRAM processScramAuthenticationInfo path and the Digest processAuthenticationInfo path i...

DEBIAN-CVE-2026-90125

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

AZL-102230 CVE-2026-90125 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

SUSE CVE-2026-75516

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

cloudmesh-client (4.2.6) potentially affected by CVE-2026-102938 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

SUSE CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...