348 matches found
CVE-2026-120808
A certificate chain-of-trust validation bypass exists in MongoDB 's macOS TLS client implementation. When using the Apple SecureTransport TLS backend , the system silently discards the trust evaluation result from SecTrustEvaluate during outbound connections to IPv6-addressed peers . An on-path a...
CVE-2026-61470
The Intel(R) TDX Migration Trust Domain (MigTD) is vulnerable to an improper control of a resource through its lifetime within its TLS client at Ring 0: Hypervisor level. A network adversary can perform a low-complexity, unauthenticated attack via adjacent access to cause a denial of service or d...
EUVD-2026-121694
Improper control of a resource through its lifetime in the MigTD's TLS client for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable data corruption...
CVE-2026-115371
A flaw was found in Incus. An improper authorization vulnerability allows an authenticated attacker using restricted Transport Layer Security TLS client certificates to retrieve storage bucket credentials. By querying the bucket keys endpoints, the attacker can obtain Simple Storage Service S3...
RustTLSX
RustTLSX 🦀 . An advanced stealth HTTP client for Rust. Built for privacy-conscious developers who need complete control over their network fingerprint. Looks like a browser. Acts like a browser. Written in Rust. Credits & Foundation Built onbogdanfinn/tls-client - the industry-leading TLS...
CVE-2022-21449
CVE-2022-21449 Zeek script to detect exploitation attempts of CVE-2022-21449 targeting TLS clients. Only works for TLS 1.2 and below. Install zkg install https://github.com/thack1/CVE-2022-21449 Run Run against supplied pcap file: $ zeek -Cr pcaps/CVE-2022-21449.pcap CVE-2022-21449 Example Notice...
CVE-2026-0073-Android-ADBD-bypass-POC
CVE-2026-0073 — Android ADBD TLS Auth Bypass EVPPKEYcmp type confusion → unauthorized ADB shell 🔥 Overview A critical authentication bypass in Android's ADB daemon adbd allows any attacker on the local network to obtain a full shell on a target device without user authorization. The vulnerability...
Forge: TLS client crash when the server sends no certificate
Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server's Certificate message, can make connection.process throw a TypeError, which crashes applications that use the forge TL...
npm: Forge: TLS client crash when the server sends no certificate
npm: Forge: TLS client crash when the server sends no certificate vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...
GHSA-525V-9GP9-W22H Forge: TLS client crash when the server sends no certificate
Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server's Certificate message, can make connection.process throw a TypeError, which crashes applications that use the forge TL...
AZL-112513 CVE-2026-118778 affecting package python-tensorboard 2.16.2-6
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...
CVE-2026-118778 Forge: TLS client crash when the server sends no certificate
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...
CVE-2026-118778 Forge: TLS client crash when the server sends no certificate
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client...
CVE-2026-118778
The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a crash in versions prior to 1.4.1 . The flaw exists in the TLS client when using forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange . Specifically, the client checks the incorrect pr...
DigitalBazaar Forge improper exception handling vulnerability
Versions of DigitalBazaar Forge prior to 1.4.1 contain an improper exception handling vulnerability. This vulnerability arises because the TLS client checks for an error attribute when determining whether a server certificate is missing. A malicious TLS server or peer on the path can omit the...
CVE-2026-114649
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...
CVE-2026-114649
The MongoDB C Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's...