rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation in the AI Assistant Network-adjacent MITM → LLM-provider API-key theft & AI-response injection Summary · Attack Flow · Affected Code · Proof · Remediation · Timeline · References 📋 At a glance | ---|--- CVE ID| CVE-2026-67598 Product|...

CVE-2025-65753

CVE-2025-65753 Proof of concept for CVE-2025-65753: Remote code execution on the Gryphon Guardian access point, firmware version 01.06.0006.22, through an improper TLS certificate validation. Description The Gryphon Guardian WiFi access point, with firmware version 01.06.0006.22, does not properl...

CVE-2026-87944

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle AiTM. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-114047 FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...

CVE-2026-114047

FreeRDP versions 2.0.0 through 3.32.0 are vulnerable to an improper certificate validation flaw within the proxy component. When no verification module is configured, the proxy accepts untrusted target TLS certificates. This allows a network-positioned attacker to intercept outbound connections a...

CVE-2026-114047 FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...

CVE-2026-114047 FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109383

The undici HTTP client library for Node.js (versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1) is vulnerable to Improper Certificate Validation (CWE-295). The Agent dispatcher performs a JSON-based deep clone of constructor options; since JSON cannot represent functions, any caller-supplied t...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

Astra Linux – Vulnerability in freerdp3

FreeRDP prior to version 3.29.0 affected versions ≤ 3.28.0 contains several vulnerabilities related to TLS certificate identity validation in functions like tlsverifycertificate, tlsmatchhostname, and x509Utilsietfgetdnsnames. Since FreeRDP performs custom matching of Common Name and DNS SAN...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

AlmaLinux 9 : nodejs:24 (ALSA-2026:73838)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73838 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

AlmaLinux 8 : nodejs:24 (ALSA-2026:74085)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

CVE-2026-78556

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication Man-in-the-Middle attack and to spoof a...

CVE-2026-109423

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

EUVD-2026-97818

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109423

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability . The software fails to validate the server certificate chain, verify the hostname, or consult the Windows certificate trust store. A network-adjacent...