1081 matches found
EUVD-2026-112489
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...
PT-2026-132349
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-119118: unclecode crawl4ai: Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to…
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...
CVE-2026-41022
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...
CVE-2026-112542
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to intercept network traffic...
EUVD-2026-110159
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to intercept network traffic...
Apple macOS security vulnerabilities
A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from permission issues and may allow malicious applications to intercept network traffic...
Apple MacOS: CVE-2026-112542: OS X update for ppp
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to intercept network traffic...
ROS-20261023-73-0207
The vulnerability of the SRT transport protocol lies in the lack of authentication for the critical function. This allows attackers to receive unencrypted data packets from any sender, enabling them to intercept streams, inject content, and interrupt direct transmission...
Electron encryption issue vulnerability
Versions prior to Electron 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6 contain an encryption vulnerability. This vulnerability arises from the failure to block compromised intermediate certificates in Chromium networking, Node.js TLS, Node.js HTTPS, or Node.js Fetch, allowing attackers possessing...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Protection Mechanism Failure in Sudo (CVE-2026-82474)
Summary IBM Watson Speech Services Cartridge is vulnerable to a Protection Mechanism Failure in Sudo due to a failure to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Sudo is used in our Speech Service Runtimes. This vulnerability has been addressed...
Updated sudo package fixes security vulnerabilities
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat. CVE-2026-82474 tz environment variable allows bypass of notbefore/notafter time-based authorization. CVE-2026-96512...
undici: undici: Certificate validation bypass via dropped TLS options in Agent
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security TLS verification functions during...
CVE-2026-113470
A flaw was found in Firefox. When dynamic updates for certificate revocation lists are disabled or unavailable, the browser relies on built-in data that fails to block certain compromised intermediate Certificate Authority CA certificates. A remote attacker could exploit this flaw using fraudulen...
K000163777: GnuTLS vulnerability CVE-2026-42012
Security Advisory Description A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier URI or Service SRV Subject Alternative Names SANs. This could cause the certificate validation proce...
undici: undici: Certificate validation bypass via dropped TLS options in Agent
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security TLS verification functions during...
undici: undici: Certificate validation bypass via dropped TLS options in Agent
A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security TLS verification functions during...
EUVD-2026-102532
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...
CVE-2026-16754: Improper Certificate Validation
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...
CVE-2026-16754
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...