73 matches found
CVE-2026-79551-Tenda
CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...
rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...
rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...
Linux Distros Unpatched Vulnerability : CVE-2026-18654
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...
CVE-2026-73809
A cleartext transmission vulnerability in Ebyte gateway products (including the NE2-D11) affects the web management interface , which does not adequately enforce transport-layer encryption . An attacker with network access could intercept authentication or session data, leading to disclosure of s...
CVE-2026-73809 Ebyte NA111-M Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...
CVE-2026-70454
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...
SUSE CVE-2026-70454
rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the TLS certificate validation process. An attacker can intercept and decrypt or tamper with encrypted sessions by presenting a self-signed or otherwise invalid certificate, exploiting the lack of prop...
AZL-95777 CVE-2026-70454 affecting package rsync for versions less than 3.5.0-1
rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...
ALPINE-CVE-2026-70454
rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...
CVE-2026-70454
rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...
CVE-2026-43910
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
CVE-2026-43910 Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Summary When directConnecttrue is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEWSESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no...
ROS-20260529-73-0015
The vulnerability in openbao is related to improper session management. Exploiting this vulnerability can allow a remote attacker to intercept a user’s session...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is characterized by scalability and dynamic monitoring. Apache Airflow suffers from a security vulnerability that stems from...
The vulnerability of the n8n automation platform, which stems from the lack of measures taken to protect the website structure, allows a hacker to intercept the session and gain access to the user account.
The vulnerability of the n8n automation platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to intercept sessions and gain control of the user account remotely...
