CVE-2026-71568 BMCtest exposes Ironic without authentication and TLS during the test

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity...

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summaryhttpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme.The transport flaw affects httpcore2 releases before...

GHSA-7MJ9-2MP8-4M2P HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...

CVE-2026-86502

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

CVE-2026-86502

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

CVE-2026-86502

JetBrains IntelliJ IDEA versions before 2026.2.2 contain a vulnerability in the IJent gRPC server , where missing TLS encryption and authentication allowed an attacker with local access to achieve arbitrary code execution on Remote Development hosts. The CVSS 3.1 score is 8.4 (High) , reflecting ...

CVE-2026-86502

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

EUVD-2026-72518

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

PT-2026-86874

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

CVE-2026-84381 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2026-84381

HTTPX2 is a next-generation HTTP client for Python. Prior to 2.10.0 , the underlying httpcore2 library failed to initiate TLS when a WebSocket connection (wss) was routed through a SOCKS5 proxy , because the TLS upgrade condition only recognized the https scheme. As a result, the WebSocket handsh...

CVE-2026-84381 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2026-84381 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

📄 DeskTime Time Tracking App 1.3.671 Missing Certificate / Remote Code Execution

DeskTime Time Tracking App version 1.3.671 has an issue where due to missing TLS certificate validation, attackers, who can inject themselves into the network path between the client and the DeskTime update servers, can return a malicious executable in response to an update request and achieve...

CVE-2020-12681

Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied...

RHEL 9 : podman (RHSA-2025:10668)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10668 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...

CVE-2023-31190 Missing TLS (HTTPS) certificate validation during firmware update in DroneScout ds230 Remote ID receiver from BlueMark Innovations

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which t...

CVE-2023-31190 Missing TLS (HTTPS) certificate validation during firmware update in DroneScout ds230 Remote ID receiver from BlueMark Innovations

DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Specifically, the firmware update procedure ignores and does not check the validity of the TLS certificate of the HTTPS endpoint from which t...