156 matches found
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
CVE-2026-118373
The LibreSSL ocspcheck utility (versions through 4.4.0 ) is vulnerable to a cleartext transmission vulnerability. The root cause is that the url2host() function discards the OCSP URL scheme, while http_alloc() only selects TLS for port 443. Consequently, an on-path network attacker can intercept ...
CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
PT-2026-127739
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and http alloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
boneIO Black authorization issue vulnerability
In boneIO Black versions from 1.2.0 up to but including 1.6.0, there is an authorization issue vulnerability. This vulnerability arises because multiple API endpoints are excluded from authentication. Unauthenticated local network remote attackers can obtain system logs, firmware version, serial...
CVE-2026-105034
The EnergizeLab Eilik NestJS auth service is vulnerable to unauthenticated device-token issuance. Due to missing and improper authentication (CWE-306, CWE-287), a remote attacker can obtain a valid device token for any arbitrary robot serial number. This allows the attacker to impersonate any dev...
CVE-2026-105034 EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...
CVE-2026-105034: Missing Authentication for Critical Function
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...
CVE-2026-22101
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...
CVE-2026-22101
A sensitive information leak exists via an obfuscated service menu accessible with physical access . This vulnerability allows an attacker to view sensitive data, including serial numbers , MAC addresses , and WiFi network passwords . No specific software or hardware versions or remediation steps...
CVE-2026-22101 Sensitive information leak through hidden menu
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...
PT-2026-102630
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...
HP Deskjet 2800 Printer Series Webservers contain Missing Authorization Vulnerability
Overview HP Printers in the Deskjet 2800 Series running firmware version =TBP1CN2612AR contain a missing authorization vulnerability tracked as CVE-2026-13753. This vulnerability allows unauthenticated access to the printer's webserver API endpoints, exposing Wi-Fi credentials, management...
DEBIAN-CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSLOCSPrespfindstatus allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two...
kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetrickeyid structure and return...
CVE-2026-49192
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping...
CVE-2026-49192
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping...
CVE-2026-49192 Summary Service Insecure Direct Object Reference
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping...