SUSE CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the fcloopt2hxmtlsrsp function not checking the status of the remoteport port. This could lead to...

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing th...

CVE-2026-28755

A flaw was found in NGINX, specifically within its ngxstreamsslmodule. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol OCSP for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security TLS...

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

Summary The /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable dela...

Malicious code in product-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b87ef85e41f2a3ee4d9e8e898f2131e8ea1b5d03c9e44368af02a6c45af73a7 The package product-status was found to contain malicious code...

MAL-2026-2385 Malicious code in product-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b87ef85e41f2a3ee4d9e8e898f2131e8ea1b5d03c9e44368af02a6c45af73a7 The package product-status was found to contain malicious code...

EUVD-2026-14887

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-1561

creationtimestamp| type| source ---|---|--- 2026-03-24 15:30:04+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3mhsvdoje7e2m 2026-03-26 00:14:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwd4t5c3w2i...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

OCSP result bypass in stream

OCSP result bypass in stream Severity: medium CVE-2026-28755 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.27.2-1.29.6...

CVE-2026-28755

CVE-2026-28755 affects both NGINX Plus and NGINX Open Source via the ngx_stream_ssl_module . The vulnerability arises from improper handling of revoked certificates when ssl_verify_client is enabled and ssl_ocsp is on, causing the TLS handshake to succeed even after an OCSP revocation check ident...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2025-41660

creationtimestamp| type| source ---|---|--- 2026-03-24 07:16:00+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-41660 2026-03-24 07:47:49+00:00| seen| https://infosec.exchange/users/certvde/statuses/116283045909330832 2026-03-24 10:33:13+00:00| seen|...

CVE-2026-4744

creationtimestamp| type| source ---|---|--- 2026-03-24 03:17:32+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4744 2026-03-24 04:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116282270051137305 2026-03-24 04:30:33+00:00| seen|...

CVE-2026-4678

creationtimestamp| type| source ---|---|--- 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260324 2026-03-24 02:00:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116281679016564532 2026-03-24 02:24:21+00:00| seen|...

CVE-2026-4673

creationtimestamp| type| source ---|---|--- 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260324 2026-03-24 01:32:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116281570422735585 2026-03-24 02:43:18+00:00| seen|...