rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

CVE-2022-0778-POC

CVE-2022-0778 のためのシンプルなリモートトリガーPOC 理由 私たちのサーバー実装が CVE-2022-0778 に対して脆弱であるかどうかをリモートで検証しようとした際、非常に煩雑であることがわかりました。BNnodsqrt の解析バグをトリガーする悪意ある証明書を作成する手順は 以前から存在していました が、主な問題は、ほとんどのクライアント実装が TLS ハンドシェイクで使用するためにクライアント証明書を解析しようとすることです。その結果、 実装が脆弱な場合、バグがトリガーされ、クライアントは CPU を 100% 使用して停止します。...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790971363)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790971363 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790971363)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790971363 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

ligolo

Ligolo : 침투 테스터를 위한, 침투 테스터가 만든 리버스 터널링 목차 소개 사용 사례 빠른 데모 성능 사용법 설정 / 컴파일 사용 방법? 요약 옵션 기능 할 일 라이선스 크레딧 소개 Ligolo 는 역방향 연결에서 SOCKS5 또는 TCP 터널을 완전한 안전성타원 곡선 TLS 인증서으로 설정하기 위한 간단 하고 가벼운 도구입니다. 이는 Autoroute + Socks4a 를 사용하는 Meterpreter 와 비슷하지만, 더 안정적이고 빠릅니다. 사용 사례 외부 감사 중 Windows / Linux / Mac 서버를...

CVE-2026-85088

A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

Security update for python-anyio

This update for python-anyio fixes the following issues: CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475. Patch Instructions: To install...

SUSE-SU-2026:4416-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: : TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

CVE-2026-80443 Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80443 Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-0073

안드로이드에서 0-Click RCE 안드로이드 ADB의 심각한 취약점 CVE‑2026‑0073, adbd 데몬의 TLS 인증서 확인에서 인증 우회 결함, 특히 adbdtlsverifycert 함수에서 TLS 인증서 확인 과정에서 무선 디버깅Wireless Debugging이 공격자를 이미 승인된 컴퓨터로 받아들이게 하여 장치의 보안을 우회할 수 있습니다. 이 취약점은 Android 14, 15, 16에서 발생합니다. 참고로 이 취약점은 안드로이드에서 adb가 활성화되어 있고 무선 디버깅도 활성화된 경우에만 악용될 수 있습니다...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — AI 어시스턴트의 TLS 인증서 검증 비활성화 네트워크 인접 MITM → LLM 공급자 API 키 탈취 및 AI 응답 주입 요약 · 공격 흐름 · 영향받는 코드 · 증명 · 수정 방법 · 타임라인 · 참고 자료 📋 한눈에 보기 | ---|--- CVE ID| CVE-2026-67598 제품| emlog/emlog — Emlog Pro 영향 범위| Emlog Pro 2.6.23까지 취약점 유형| CWE-295: 부적절한 인증서 검증 CVSS v4.0| 9.1 — 치명적Critica...

CVE-2026-15911

A flaw was found in confluent-kafka. The HashiCorp Vault Key Management Service KMS integration fails to properly validate Transport Layer Security TLS certificates by default. A remote attacker able to intercept network traffic could exploit this flaw to intercept and decrypt sensitive data or...

EUVD-2026-91026

The Joyland AI app accepts any TLS certificates from any server without validation...

CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

EUVD-2026-91008

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-15911

The Confluent Kafka Python client contains a vulnerability in its HashiCorp Vault KMS integration due to a failure to properly validate Transport Layer Security (TLS) certificates by default. A remote attacker capable of intercepting network traffic could exploit this flaw to intercept and decryp...

CVE-2026-103921

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

PYSEC-2026-4025 AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Impact Services using internationalized non-ASCII domain names are potentially vulnerable to TLS connections made from AnyIO's connecttcp or directly via TLSStream.wrap where the connection has through other means been hijacked and redirected to a malicious server. The attacker would obtain a...