CVE-2026-63310

CVE-2026-63310 (now rejected by its CNA) tracks a vulnerability in NLTK before 3.9.3 where the package downloader in nltk/downloader.py performs no integrity verification between moving a downloaded file to its final location and extracting it. The SHA-256 checksum logic exists in _pkg_status() b...

CVE-2026-63310

...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

EUVD-2026-63700

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due to the exposure of sensitive information...

CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-53583 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-53583 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-53583

In libgit2 before 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp in the GEN_IPADD branch, so OpenSSL builds accept mismatched IP SubjectAltName certificates and reject matching ones, enabling a network attacker to intercept IP-literal HTTPS connecti...

CVE-2026-66787

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-controlled IP addresses, causing other clusters'...

CVE-2026-66787 Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-54481

A flaw was found in Gitea. The internal API HTTP client is configured to skip Transport Layer Security TLS certificate verification, which is an insecure practice. A remote attacker on the same network segment could exploit this vulnerability to perform man-in-the-middle MITM attacks. This allows...

CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

OESA-2026-3427 open-isns security update

The open-isns package consists of the iSNS server and client programs, which is a partial implementation of the iSNS protocol. The iSNS protocol is defined in RFC 4171 and the purpose of which is to allow it automated and convenient to discover, manage, and configure iSCSI devices. Security Fixes...

OESA-2026-3407 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

EUVD-2026-62927

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...

CVE-2026-53583: Improper Certificate Validation

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

CVE-2026-76403

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol HTTP Event Collector in Splunk Enterprise. The vulnerability...