zen-desktop v0.25.1

Zen: Your Comprehensive Ad-Blocker and Privacy Guard There is, simply, no way, to ignore privacy. Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. Edward Snowden, Permanent Record Website • Mastodon • Bluesky • Discord •...

CVE-2026-41012

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012

CVE-2026-41012 is a traffic interception vulnerability in BOSH Director vSphere CPI (all versions prior to v98.0.6 ) caused by insufficient certificate validation and pinning in the communication between BOSH Director and vCenter. An attacker positioned between the two can impersonate the vCenter...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012: Improper Certificate Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the SendPamAuthPacketFactory function. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack or controlling a malicious server that issues an Authentication...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the authentication. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack during the initial handshake. Note: This is only exploitable if SSL/TLS is enabled...

CVE-2026-18717

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: ibus (UTSA-2026-031617)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031617 advisory. A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a...

PT-2026-83343

Name of the Vulnerable Software and Affected Versions Arc versions 26.02.1 through 26.06.1 Description Arc Enterprise clustering allows cluster join requests without authentication when cluster.enabled is set to true but cluster.shared secret is not configured. A network attacker who can reach th...

CVE-2026-18717: Improper Certificate Validation

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-73809

A cleartext transmission vulnerability in Ebyte gateway products (including the NE2-D11) affects the web management interface , which does not adequately enforce transport-layer encryption . An attacker with network access could intercept authentication or session data, leading to disclosure of s...

CVE-2026-73809 Ebyte NA111-M Cleartext Transmission of Sensitive Information

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

CVE-2026-73809 Ebyte NA111-M Cleartext Transmission of Sensitive Information

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

PYSEC-2026-3797

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-59272

Spring AMQP 's Log4j2 AmqpAppender disables TLS hostname verification by default . Any application using this appender to ship logs to RabbitMQ over TLS, while relying on the documented default, is exposed to man-in-the-middle interception of every log event. The vulnerability is rated MEDIUM (CV...

EUVD-2026-67093

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...