SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

GHSA-62RC-F4V9-H543 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

CVE-2026-0924

BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2...

CVE-2026-25060 OpenList Insecure TLS Default Configuration

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig function in internal/conf/config.go. This vulnerability enables...

CVE-2026-25060 OpenList Insecure TLS Default Configuration

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig function in internal/conf/config.go. This vulnerability enables...

GHSA-GWCH-7M8V-7544 terraform-provider-proxmox has insecure sudo recommendation in the documentation

Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead. Summary In the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system. Details The following line were suggested for addition in the...

CVE-2026-0924

CVE-2026-0924 affects BuhoCleaner 1.15.2. The Red Hat/NVD notes describe an insecure XPC service that allows local, unprivileged users to escalate privileges to root via insecure functions. The provided documents identify the affected component as the BuhoCleaner XPC service and indicate local pr...

CVE-2026-0924 BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack

BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2...

CVE-2026-0924 BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack

BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2...

OpenList has Insecure TLS Default Configuration

Summary The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle MitM attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations,...

Exploit for CVE-2025-60865

CVE Disclosures | Findings...

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

A flaw was found in foremankubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority CA certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and...

CVE-2026-1531 Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification

A flaw was found in foremankubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority CA certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and...

📄 MiniCMS 1.11 Exploitation Toolkit

This toolkit focuses on validating and demonstrating the impact of a known and documented design flaw in MiniCMS 1.11 related to its build process CVE-2018-1000638. MiniCMS relies on an insecure build.php script that blindly packages filesystem contents into install.php without enforcing integrit...

PT-2026-5724

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.1.10 Description The OpenList application disables TLS certificate verification by default for all outgoing storage driver communications, creating a risk of Man-in-the-Middle MitM attacks. This allows attackers to...

PT-2026-6295

Name of the Vulnerable Software and Affected Versions Terraform / OpenTofu Provider versions prior to 0.93.1 Description The Terraform / OpenTofu Provider for Proxmox Virtual Environment, prior to version 0.93.1, contains an insecure sudoer line in its SSH configuration documentation. This...

PT-2026-5707

Name of the Vulnerable Software and Affected Versions BuhoCleaner version 1.15.2 Description BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root. This is achieved through insecure functions within the XPC service. Recommendations...

Grafana API Privilege Escalation

The vulnerability of the application programming interface of the Grafana monitoring and observation platform is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and gain unauthorized access to protected informatio...

Alibaba Cloud Linux 3 : 0019: open-vm-tools (ALINUX3-SA-2026:0019)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0019 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-22247: VMware Tools contains an insecure...

Dr.Buho BuhoCleaner: Race Condition Vulnerability

Dr.Buho BuhoCleaner is a system cleaning and optimization software developed by Dr.Buho Company in China. Version 1.15.2 of Dr.Buho BuhoCleaner contains a vulnerability related to race conditions, which stems from an insecure XPC service. This vulnerability may lead to privilege escalation...