io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security TLS ClientHello messages to bypass the Server Name Indication SNI routing mechanism. This forces a fallback to a less secure...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

1Panel-CVE-2025-54424-

CVE-2025-54424 CVE-2025-54424：1Panel Client Certificate Bypass RCE Vulnerability All-in-One Tool Scan + Exploit Vulnerability Overview 1Panel is an open-source, modern Linux operation and maintenance panel that provides a graphical interface for deploying websites, managing servers, and running...

CVE-2026-114614

A flaw was found in Authlib. The library's transport security verification improperly validates web addresses by using prefix matching to exempt local loopback addresses from encryption requirements. A remote attacker can exploit this issue by supplying a crafted URL containing local host...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

Security Bulletin: Multiple Security Vulnerabilities in Netty affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-59902 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

Authlib input validation error vulnerability

Versions of Authlib prior to 1.8.0 contain a security vulnerability. This vulnerability arises because authlib.common.security.issecuretransport uses a text prefix comparison when handling HTTP redirects; it erroneously treats URLs starting with “userinfo” on a loopback host as secure...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

Atlassian Confluence < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104520)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104520 advisory. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-75595, CVE-2026-75596, CVE-2026-62243)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

Atlassian Jira Service Management Data Center and Server 5.9.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16781)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16781 advisory. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and...

Astra Linux – vulnerability in curl

A user can specify that curl version = 7.20.0 and = 7.78.0 must perform a successful TLS upgrade when communicating with an IMAP, POP3, or FTP server by using --ssl-reqd on the command line or setting CURLOPTUSESSL to CURLUSESSLCONTROL or CURLUSESSLALL via libcurl. This requirement can be...

io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security TLS ClientHello messages to bypass the Server Name Indication SNI routing mechanism. This forces a fallback to a less secure...

CVE-2026-83535

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security TLS, the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open...

PT-2026-107624

Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 29.8.2 Moby versions prior to 2.0.0-beta.25 Description Docker Engine classifies a registry hostname as insecure using an any-match DNS check. The loadInsecureRegistries function injects 127.0.0.0/8 and ::1/128 ...

Security Bulletin:Netty Vulnerability: IndexOutOfBoundsException in SslClientHelloHandler Leading to Mutual TLS Bypass

Summary Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records c...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295

GitAhead versions 2.5.0 through 2.7.1 are vulnerable to an insecure update mechanism that fails to perform integrity or signature verification on downloaded updates. Additionally, the application permanently ignores TLS errors after a single SSL error dialog is presented. A network attacker can e...