CVE-2025-29419

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

CVE-2026-81034

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-54548

kas is a setup tool for bitbake-based projects. Prior to version 5.4 , when internal SSH key setup is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no user-specific SSH configuration exists, the function ssh_no_host_key_check() in kas/libcmds.py creates ~/.ssh/config with a global Hos...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

EUVD-2025-210783

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

CVE-2026-54548: Improper Certificate Validation

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2025-29419

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

The vulnerabilities of the functions mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() in the src/tls_builtin.c file of the Mongoose library allow attackers to carry out “man-in-the-middle” type attacks.

The vulnerabilities of the functions mgtlsverifycertsan and mgtlsverifycertcn in the src/tlsbuiltin.c file of the Mongoose library are related to errors in the certificate validation process. Exploiting these vulnerabilities could allow a remote attacker to perform “man-in-the-middle” attacks...

PT-2026-82229

Name of the Vulnerable Software and Affected Versions CTFd version 3.7.6 Description CTFd is susceptible to a man-in-the-middle attack, which occurs when an attacker intercepts and potentially alters communication between two parties who believe they are communicating directly with each other...

CVE-2025-29419: Channel Accessible by Non-Endpoint

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

CVE-2025-29419

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

CVE-2025-29419

The software CTFd v3.7.6 is vulnerable to a man-in-the-middle attack . While the specific root cause and technical components involved are not detailed in the provided documents, the vulnerability was assigned a High base severity score of 7.1 . No remediation steps, exploit details, or specific ...

Security Bulletin: Vulnerability in pgjdbc affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in pgjdbc has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabilit...

CVE-2026-79785

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

CVE-2026-79785 X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

EUVD-2026-65063

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

CVE-2026-78323 Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...