9432 matches found
CVE-2026-15925: Improper Validation of Certificate with Host Mismatch
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...
PT-2026-60670
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...
PT-2026-93903
Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.7 Description CoreDNS contains an unauthenticated denial-of-service issue where the server parses attacker-controlled DNS section counts before validating the fixed header. This occurs within the DNS-over-HTTPS D...
CVE-2026-52842
creationtimestamp| type| source ---|---|--- 2026-07-15 16:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp62iew3x2w 2026-07-15 19:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgm3qmkx2s...
Malicious Package
Overview gta5rp-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...
Malicious Package
Overview throne-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...
Malicious Package
Overview rusfish4-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to...
Malicious Package
Overview calc-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to the...
Uncaught Exception
Overview std/net is a Go standard library package std/net Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Remediation Upgrade std/net to...
CVE-2026-51105
creationtimestamp| type| source ---|---|--- 2026-07-14 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e 2026-07-22 05:03:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24...
XenServer Security Update for CVE-2026-42491
Severity: Medium Description of Problem An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted...
PT-2026-58855
Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...
Improper Certificate Validation
Overview DIRAC is an interware, meaning a software framework for distributed computing. Affected versions of this package are vulnerable to Improper Certificate Validation in the process that downloads and executes the second stage pilot script over an unverified HTTPS connection. An attacker can...
PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...
PT-2026-58934
Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send path becomes an outbound-request sink when VAPID delivery is enabled. The practical result is an authenticated, stored, mostly blind SSRF primitive to arbitrary HTTPS endpoints reachab...
Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
Malicious code in tinyparrot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...
FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline
Fetch and execute an x86 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...
FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...