CVE-2025-61778 Akka.Remote TLS did not properly implement certificate-based authentication

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections...

CVE-2025-61778 Akka.Remote TLS did not properly implement certificate-based authentication

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our akka.remote.dot-netty.tcp transport and this would correctly enforce private key validation on the server-side of inbound connections...

Akka.NET 访问控制错误漏洞

Akka.NET is a distributed concurrent programming framework in the Akka.NET open source. An access control error vulnerability exists in Akka.NET versions 1.2.0 through 1.5.51, which stems from a failure to implement mutual TLS authentication and could lead to unauthorized access...

PT-2025-40934

Name of the Vulnerable Software and Affected Versions Akka.NET versions 1.2.0 through 1.5.51 Description Akka.NET, a .NET port of the Akka project, has an issue where the Akka.Remote component did not implement mutual TLS mTLS in versions 1.2.0 through 1.5.51. When TLS was enabled via the...

EUVD-2025-21696

Malicious code in bioql PyPI...

EUVD-2022-30300

Malicious code in bioql PyPI...

EUVD-2024-22958

Malicious code in bioql PyPI...

EUVD-2023-35451

Malicious code in bioql PyPI...

EUVD-2022-0216

Malicious code in bioql PyPI...

EUVD-2022-30953

Malicious code in bioql PyPI...

CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not...

CVE-2025-59353

Technical details beyond the initial description are not provided in the connected sources. Monitor for updates from vendor/security advisories for CVE-2025-59353.

PT-2025-38272

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description A peer can obtain a valid TLS certificate for arbitrary IP addresses, rendering the mTLS authentication ineffective. The Manager’s Certificate gRPC service does not validate if the requested IP...

DragonFly's manager generates mTLS certificates for arbitrary IP addresses

A peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the pee...

Linux Distros Unpatched Vulnerability : CVE-2019-19272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer a variable initialized to NULL leads to a crash when...

Linux Distros Unpatched Vulnerability : CVE-2019-19269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL...

Linux Distros Unpatched Vulnerability : CVE-2018-8019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked clie...

PT-2025-33679 · Vaultls · Vaultls

Name of the Vulnerable Software and Affected Versions: VaulTLS versions prior to 0.9.1 Description: VaulTLS is a solution for managing mTLS mutual TLS certificates. User accounts created through the User web UI have an empty password set, allowing attackers to log in with a blank password...

Linux Distros Unpatched Vulnerability : CVE-2022-25640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificateverify messag...

Hard-Earned Lessons in Access Control at Scale: Enforcing Identity and Policy across Trust Boundaries with Reverse Proxies and MTLS

In today's enterprise environment, traditional access methods such as Virtual Private Networks VPNs and application-specific Single Sign-On SSO often fall short when it comes to securely scaling access for a distributed and dynamic workforce. This paper presents our experience implementing a...