CVE-2026-79390

The Trueview TI8161 (version 6.0.23.4 ) is susceptible to information disclosure because it transmits MQTT communications in plaintext over TCP port 1883 . An unauthenticated attacker positioned on the same network segment can intercept this traffic to harvest sensitive data, including device ide...

CVE-2026-77847: Use of Hard-coded Credentials

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

EUVD-2026-70599

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...

OPCFoundation OPC UA LocalDiscoveryServer (LDS)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

PT-2026-85084

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS CERTIFICATE VALIDATION environment variable is unset or set to false, the...

PT-2026-85284

Name of the Vulnerable Software and Affected Versions MOOS-IvP uFldNodeBroker versions prior to 24.8.2 Description The uFldNodeBroker fails to validate the source of TRY SHORE HOST messages on the vehicle bus. This allows any publisher to enroll shore routes controlled by an attacker, enabling th...

PT-2026-85376

Name of the Vulnerable Software and Affected Versions OPCFoundation OPC UA LocalDiscoveryServer versions prior to 1.04.420 Description A privilege-escalation flaw exists in the installer that allows local attackers with keyboard and display access to intercept a high-privilege console during...

Linux Distros Unpatched Vulnerability : CVE-2026-59272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of...

CVE-2026-20355

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20354

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20355 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

GHSA-FRJ6-5RHH-VWFW Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false...

Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false...

UBUNTU-CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662 Nodemailer before 8.0.8 TLS Certificate Validation Bypass

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js via rejectUnauthorized: false. This allows an attacker in a machine-in-the-middle position to intercept OAuth2 token requests over compromised HTTPS connections, capturing OAuth client secrets , refresh tokens , a...

CVE-2026-82662: Improper Certificate Validation

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

PT-2026-83727

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...