56665 matches found
EUVD-2026-85162
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...
CVE-2026-91812
A vulnerability in the Foxit PDF Editor/Reader update mechanism (specifically FoxitUpdater ) allows man-in-the-middle attackers to bypass certificate validation and package integrity checks . This flaw could potentially enable arbitrary code execution with system privileges . No specific remediat...
CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...
A library for client-side APIs for the IMAP protocol, written in Ruby. This issue involves insufficient checking of unusual or exceptional states, allowing attackers to execute “man-in-the-middle” attacks.
The vulnerability in the client API library for the IMAP protocol, written in Ruby, relates to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...
The vulnerability of the automation tool for configuring and building projects based on BitBake lies in the improper verification of the SSH key, allowing an attacker to execute a “man-in-the-middle” attack.
The vulnerability of the automation tool for configuring and building projects based on BitBake is related to incorrect verification of the SSH key. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack...
The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain unauthorized access to protected information.
The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
CVE-2026-91812: Improper Certificate Validation
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...
PT-2026-97568
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When no CA bundle is available, the ssl options/1 function fal...
Linux Distros Unpatched Vulnerability : CVE-2026-95366
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in Core. CVE-2026-95366 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...
CVE-2026-96546: Out-of-bounds Read
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...
The vulnerability of software for storing images in OpenEXR format, which has a wide dynamic range of brightness levels, arises from the possibility of the operation exceeding the buffer boundaries in memory. This allows an attacker to cause a service failure.
The vulnerability of software for storing images with a wide dynamic range of brightness in the OpenEXR format is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-67404: Improper Certificate Validation
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssloptions/1 falls back to verify, verifynone with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker...
PT-2026-97231
Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists in the update mechanism of the software where improper certificate validation occurs. This allows a man-in-the-middle attacker to bypass package integrity...
CVE-2026-93601
A flaw was found in rustls-webpki. This component incorrectly processes DNS Domain Name System name constraints for certificates asserting a wildcard name. This could allow a misissued wildcard certificate to be accepted for a domain that should be outside its permitted scope. Consequently, this...
GHSA-9Q4H-F4X5-FFQ8 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
Summary The V1 DurableTask stream handler registers worker-supplied durable task external IDs in an in-memory callback routing map before verifying that the authenticated tenant owns the task. If the tenant-scoped ownership check fails, the handler logs the error and continues, but the map entry...
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...
CVE-2026-76715 Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...
CVE-2026-76715 Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...
CVE-2026-76715
A vulnerability in an administrative component of the HPE Networking Analytics and Location Engine (ALE) allows an unauthenticated remote attacker to perform a man-in-the-middle (MitM) attack. Successful exploitation can lead to remote code execution with root privileges on the affected appliance...
