CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

PT-2026-71654

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.0 through 3.2.3 rsync-ssl versions prior to 3.4.5 Description A TLS certificate validation issue allows on-path attackers to intercept encrypted sessions by presenting self-signed or invalid certificates. This occurs because...

EUVD-2026-52885

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...

CVE-2026-41714

A flaw was found in Spring AMQP. Applications that configure their broker connection using RabbitConnectionFactoryBean.setUri"amqps://..." without explicitly enabling SSL via setUseSSLtrue may establish a TLS Transport Layer Security encrypted connection without proper certificate validation or...

EUVD-2026-50018

IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-16107 TS4500 CLI tool addresses security vulnerability

IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

RockyLinux 10 : nodejs24 (RLSA-2026:35841)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:35841 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

RHCOS 4 : OpenShift Container Platform 4.15.66 (RHSA-2026:28961)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28961 advisory. - golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 - crypto/x509: golang: Denial of Service...

CVE-2026-45170 Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17...

CVE-2026-0420

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle MiTM style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models...

CVE-2026-0420 Missing TLS certificate validation in NETGEAR's ReadyCloud client app

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle MiTM style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models...

CVE-2026-44213

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the...

OpenTelemetry Collector Contrib 信任管理问题漏洞

OpenTelemetry Collector Contrib is an extensible telemetry data collection component library developed by OpenTelemetry - CNCF. Versions of OpenTelemetry Collector Contrib prior to 1.1.0 contained a trust management vulnerability. This vulnerability stemmed from the lack of validation of HTTPS/TL...

RHCOS 4 : OpenShift Container Platform 4.18.42 (RHSA-2026:17446)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17446 advisory. - golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 - golang: net/url: Memory exhaustion in quer...

RHCOS 4 : OpenShift Container Platform 4.17.54 (RHSA-2026:17595)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17595 advisory. - golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 - golang: net/url: Memory exhaustion in quer...

GHSA-WFR5-454P-MJC2 OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

Summary The OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANAENDPOINTPROXY environment variable. If a network attacker can Man-in-the-Middle MitM the...

RHCOS 4 : OpenShift Container Platform 4.18.37 (RHSA-2026:6552)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:6552 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 Note that Nessus has not tested for...

CVE-2025-10539 Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3725 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0098...