cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1

cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1...

CVE-2026-76261 Insecure Default Access Control List through the REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected...

CVE-2026-76244

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

EUVD-2026-62408

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76244

stigmem-node (eidetic-labs) contains an insecure default configuration in its federation transport that permits federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback ...

PT-2026-78425

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-74882

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

PYSEC-2026-3744

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882

openssl_encrypt versions before 1.4.0 ship with an insecure default in its IntegrityProxyConfig trusted_proxies that trusts the entire RFC 1918 private address space. This allows attackers on private networks to forge client certificate headers and bypass mTLS authentication when ProxyAuth valida...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

PT-2026-76567

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

PT-2026-75964

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

CVE-2026-33921

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to...

CVE-2026-33921

CVE-2026-33921 maps to a Windows RPC Runtime (rpcrt4.dll) vulnerability where NdrComplexTypeBufferSize underflows, enabling a pre-auth heap-based overflow (Ghost-Call) via RPC/SMB without credentials. Impact: potential remote code execution with SYSTEM privileges on affected Windows hosts; exploi...

Sharp Network Scanner Tool insecure initial configuration

Overview Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation are Windows applications which work as FTP servers and accept scan outputs from MFPs. With the initial configuration, anyone can upload files unlimitedly without authentication. Initialization of a Resource...

Schneider Electric EcoStruxure Panel Server Initialization of a Resource with an Insecure Default (CVE-2026-6866)

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials. This plugin only...