CVE-2026-59247

CVE-2026-59247 describes an integrity issue in Gleam where dependency resolution can be hijacked by a network attacker. During resolution, Gleam fetches signed repository metadata but then queries an unsigned API for release data and writes the outer_checksum and dependency names into manifest.to...

UBUNTU-CVE-2026-55995

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb...

CVE-2026-55995 Double-free in the iSNS attribute decoder in open-iscsi

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb...

CVE-2026-55995

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb...

CVE-2026-55995

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb...

ALSA-2026:47757 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenS...

Linux Distros Unpatched Vulnerability : CVE-2026-55995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through...

PT-2026-65798

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

PT-2026-65797

Name of the Vulnerable Software and Affected Versions open-iscsi versions prior to 56718d4e9d1a4f51c30697b5c0534144bb41c9bb Description A Double Free issue allows an unauthenticated man-in-the-middle MITM attacker to cause a denial of service DoS. A Double Free occurs when the program attempts to...

CVE-2026-16107

IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-16107

IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-16107 TS4500 CLI tool addresses security vulnerability

IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-16107

Summary: IBM TS4500 CLI tool (versions 0.1.31–1.12.0.0) does not validate TLS server certificates, enabling potential MitM information disclosure. Root cause: improper TLS certificate validation in the CLI component. Impact: exposure of sensitive information under network attack. Affected product...

CVE-2026-66053

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

EUVD-2026-49323

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the matchName function in the C++ TSSLSocket implementation, which fails to properly validate hostnames against SSL/TLS certificates according to RFC 6125. An attacker can bypass...

CVE-2026-54342

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

CVE-2026-54342 TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

EUVD-2026-48604

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

EUVD-2026-48560

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...