59091 matches found
CURL-CVE-2026-87866 wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...
CURL-CVE-2026-87865 knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
wolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...
knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-108064
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...
CVE-2026-107171
A Hardcoded Cryptographic Key vulnerability exists in Trellix Agent 5.8.4 within the mfecryptc.dll component. This flaw allows Regular Users to perform Database Decryption , leading to a high impact on confidentiality. No specific remediation or exploit information is provided in the documents.
CVE-2026-107171
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users...
EUVD-2026-100894
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users...
CVE-2026-107171
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users...
curl: CVE-2026-111482: libssh2 knownhosts prefix match
AI Disclaimer: I've written this report with the help of AI, please feel free to let me know if I made a mistake, I've read the final revision of this report a few times to ensure it was solid but my understanding of the inner workings of curl and libssh is where I can fall short. Summary:...
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
CVE-2026-110458
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device...
CVE-2026-110457
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device...
CVE-2026-108064
The WP Encryption WordPress plugin versions before 7.8.8.2 contains a vulnerability in its SSL certificate-provisioning routine. Due to a lack of capability or nonce checks on the wple_auto_handler , unauthenticated users can overwrite the site's certificate private key and replace pending Let's ...
EUVD-2026-100848
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...
CVE-2026-108064 WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate...
CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
UBUNTU-CVE-2026-87865
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...
CVE-2026-110459
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...