62056 matches found
PT-2026-75950
A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security TLS connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle MITM attacker to intercept and harvest vCenter administrator credentials. This can lead to...
Check Point Security Gateways IKEv1 Man-in-the-Middle
The vulnerability of the Internet Key Exchange IKEv1 protocol implemented by Check Point Security Gateways and Check Point Spark Firewall is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to carry out “man-in-the-middle” attacks and...
EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2276)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 crypto: algifaead - Revert to operating out-of-placeCVE-2026-31431 Tenable has...
EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2275)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 crypto: algifaead - Revert to operating out-of-placeCVE-2026-31431 Tenable has...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the SSH connection process. An attacker can obtain highly sensitive credentials by intercepting or redirecting the SSH session during node configuration. This is only exploitable if the attacker has...
js-cookie input validation error vulnerability
JavaScript Cookie is a lightweight JavaScript cookie operation library developed by js-cookie. Versions of JavaScript Cookie prior to 3.0.7 contained security vulnerabilities. These vulnerabilities stemmed from the use of the for...in loop and standard assignment methods to copy properties within...
PT-2026-48448
Name of the Vulnerable Software and Affected Versions assisted-migration-agent affected versions not specified Description The application hardcodes insecure Transport Layer Security TLS connections when communicating with vCenter. This design flaw allows a Man-in-the-Middle MITM attacker to...
cve-2026-40996 - MEDIUM - Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
cve-2026-40996 - MEDIUM - Inbound WS-Security allows RSA PKCS1 v1.5 key transport by default...
PT-2026-48557
Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XSOAR engine software running on Linux affected versions not specified Description A path traversal issue exists due to improper restriction of directory path names. This allows an unauthenticated attacker on an...
PT-2026-48452
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents...
CVE-2026-7516: Exposed Dangerous Method or Function
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents...
PT-2026-48533
Name of the Vulnerable Software and Affected Versions TDengine versions 3.4.0.0 through 3.4.1.5 Description An unauthenticated remote attacker can cause the taosd server process to crash by sending a single crafted RPC Remote Procedure Call packet. This action does not require any credentials or ...
PT-2026-48482
Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 2.0.0 through 2.0.13 Description Private services configured with EnableShowInService: false are enumerable, leading to the leak of service names and timing data. While the main service-listing endpoint correctly...
Lenovo Android Application security vulnerabilities
Lenovo Android Application is an application developed by Lenovo Corporation, designed for managing Lenovo devices. There is a security vulnerability in Lenovo Android Application, which stems from websites accessed via the built-in browser potentially overwriting system clipboard contents...
CVE-2026-53475: Improper Certificate Validation
A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security TLS connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle MITM attacker to intercept and harvest vCenter administrator credentials. This can lead to...
CVE-2026-44716 Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner src/pipecat/runner/run.py. When the runner is started with the --folder...
CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trustremotecode=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue...
CVE-2026-46517
LMDeploy has a hardcoded trust_remote_code=True path in multiple code locations (e.g., get_model_arch and related calls) that is invoked for every model load. This creates an implicit unsafe remote-code load path when loading HuggingFace models from a repository, with no user opt-out or CLI flag ...
