CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

CVE-2026-117499

The @fastify/session plugin for Fastify is vulnerable to a session revocation bypass via a logout race condition in all releases before 11.1.6 . With default rolling session behavior, a request that restores a session before a logout can save a copy after a concurrent request completes the destro...

OpenWisp Controller authorization issue vulnerability

OpenWisp Controller versions from 1.0.0 up to but including version 1.3.2 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks; authenticated organization administrators can request certificate revocation lists from other organizations via...

PT-2026-126706

Name of the Vulnerable Software and Affected Versions OpenWISP Controller versions 1.0.0 through 1.3.1 Description An authenticated organization manager with CA view permission can retrieve the certificate revocation list of another organization. This occurs because the CrlDownloadView.retrieve...

Security Bulletin:Multiple vulnerabilities in netty-handler-ssl-ocsp may affect IBM Infosphere Change Data Capture (CVE-2026-93493, CVE-2026-93578)

Summary Multiple security vulnerabilities have been identified in netty-handler-ssl-ocsp, Netty/Handler/Ssl/Ocsp. netty-handler-ssl-ocsp is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details...

UBUNTU-CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

Amazon Linux 2023 : firefox (ALAS2023-2026-3329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3329 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Apache Tomcat Util Accepted Misconfigured CRLs

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List CRLs for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted. This issue...

Python CPython encryption issue vulnerability

Python versions CPython 3.16.0 and earlier contain an encryption vulnerability stemming from improper certificate revocation checks in the ssl module. Without proper certificate revocation configuration, the system may accept known compromised certificates...

Medium: firefox

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Medium: firefox

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

FreeBSD : ca_root_nss -- trusted root certificate from compromised CA eMudhra (b755b277-cf12-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b755b277-cf12-11f1-bae2-3497f65b111b advisory. eMudhra generated several of its TLS intermediate CA certificates with trivially small private keys,...

Alpine Linux: CVE-2026-115557: Improper Check for Certificate Revocation

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

Improper Check for Certificate Revocation

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...

Improper Check for Certificate Revocation

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...

SUSE CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities were found in dependent open source libraries used by IBM Quantum Safe Explorer. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-73581 DESCRIPTION: Improper Chec...