CVE-2025-26465

CVE-2025-26465 The OpenSSH client contains a logic error between versions 6.8p1 to 9.9p1 inclusive that makes it vulnerable to an active MitM attack if the VerifyHostKeyDNS option is enabled, allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to i...

CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190

The Forge (node-forge) JavaScript TLS library versions prior to 1.4.1 contain a vulnerability in pki.verifyCertificateChain() where deprecated extension OIDs 2.5.29.10 and 2.5.29.13 are incorrectly parsed as basicConstraints . This oversight allows an attacker to bypass certificate constraints by...

CVE-2020-8289

CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backblaze Summary Name: Remote Code Execution as SYSTEM/root via Backblaze CVE: CVE-2020-8289 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: Critical Discovery Date: 2020-03-13...

nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames

A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...

SUSE CVE-2026-115693

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-115693

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/1 to eve...

CVE-2026-108013

BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with...

CVE-2026-106069

A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...

CVE-2026-115570 Electron: Mitigation for compromised eMudhra intermediate certificates

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch...

CVE-2026-115570

The Electron framework, used for building cross-platform desktop applications, is vulnerable in versions prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6 . The root cause is the failure to block compromised eMudhra intermediate certificates across Chromium networking , Node.js tls , Node.js h...

[SECURITY] [DSA 6580-1] erlang security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6580-1 [email protected] https://www.debian.org/security/ Aron Xu October 23, 2026 https://www.debian.org/security/faq -...

Debian dsa-6580 : erlang - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6580 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6580-1 [email protected] https://www.debian.org/securit...

Security Bulletin: Multiple Security Vulnerabilities in HttpClient affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-64607, CVE-2026-71290)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if ...

php: php: Server impersonation via Common Name fallback in TLS verification

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch the checkServerIdentity function in lib/tls.js. An attacker can cause a TLS client to accept a certificate that does not identify the connected peer by supplying a non-canonical...

CVE-2026-113812

A flaw was found in Mozilla::CA. The Certificate Authority CA bundle includes a root certificate linked to compromised intermediate certificates. A remote attacker capable of intercepting or redirecting network traffic could exploit this flaw using the compromised keys to impersonate a Transport...

Red Hat: CVE-2026-113812: perl-mozilla-ca: Mozilla::CA: TLS server impersonation via compromised intermediate certificates

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able...

Linux Distros Unpatched Vulnerability : CVE-2026-107675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersona...

SUSE CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...