CVE-2026-78021: Generation of Error Message Containing Sensitive Information

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and...

CVE-2026-78019: Inclusion of Functionality from Untrusted Control Sphere

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesyst...

CVE-2026-78018: Initialization of a Resource with an Insecure Default

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-78013: Initialization of a Resource with an Insecure Default

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information...

CVE-2026-78027: Server-Side Request Forgery (SSRF)

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery SSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery...

PT-2026-108775

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information...

PT-2026-108798

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An authorization bypass exists due to a user-controlled key. A low privileged attacker with remote access can exploit this issue to achieve elevation of...

CVE-2026-78017: Improper Check for Unusual or Exceptional Conditions

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection...

CVE-2026-88648

A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority CA can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure PKI restrictions. This allows unauthorized certificates to be accepted as valid, potentially...

GHSA-P2JM-6HJ6-9RJG AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

EUVD-2026-94643

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source...

PT-2026-108664

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

PVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks

Federated learning allows dispersed oilfield sites to train a shared intrusion detector without pooling network traffic, yet its aggregation step forces a choice between privacy and robustness. Byzantine-robust rules must read each update in the clear, whereas secure aggregation hides updates fro...

PT-2026-108705

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 2.16.1 AsyncHttpClient versions 3.0.0 through 3.0.13 Description The ThreadSafeCookieStore in the AsyncHttpClient library fails to track whether a Set-Cookie response was received via a secure transport...

Fedora 44 : curl (2026-8efcd7a2a0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8efcd7a2a0 advisory. - fix secure cookie attribute bypass with tab CVE-2026-80255 - fix OpenSSL provider use-after-free CVE-2026-80229 ---- - Fix HTTP/2 server push UAF...

CVE-2026-107283

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

DEBIAN-CVE-2026-107283

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...

CVE-2026-76280

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

CVE-2026-76272

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user i...