kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker

A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...

CentOS Linux 7 [TuxCare] Security Update: nettle / nettle-devel (CENTOS7:CLSA-2024:1709839956)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1709839956 advisory. - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS1 v1....

CVE-2026-96770

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-96770 s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-96770 s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-96770: Improper Following of a Certificate's Chain of Trust

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

Linux Distros Unpatched Vulnerability : CVE-2026-85718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a...

CVE-2026-92943

AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 (Python 3.7+) contain an improper certificate validation flaw in the MQTT client TLS connection layer. An adversary-in-the-middle can present a certificate issued for an unrelated hostname by a CA already in the device trust store, thereb...

CVE-2026-92943: Improper Validation of Certificate with Host Mismatch

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-85718: Uncontrolled Resource Consumption

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

PT-2026-95074

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 Description Improper validation of certificates with host mismatch occurs in the MQTT client TLS connection layer, specifically affecting X.509 mutual authentication on port 8883 and...

CVE-2026-84850: Improper Certificate Validation

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3328)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

AZL-99837 CVE-2026-80229 affecting package rust 1.75.0-31

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

EUVD-2026-72167

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

CVE-2026-80229 OpenSSL provider use-after-free

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

Improper Certificate Validation

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Improper Certificate Validation in the OCSP processing functionality, which accepts an OCSP response without checking that its CertID matches the certificate being validated...

CVE-2026-14681

A flaw was found in PostgreSQL. Improper enforcement of message integrity in PostgreSQL's GSSAPI Generic Security Service Application Program Interface support allows a user to negotiate GSSAPI contrary to pghba.conf rules by initiating a direct TLS Transport Layer Security connection. This enabl...

Insufficiently Protected Credentials

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the authSwitchRequest handling in lib/commands/authswitch.js and the direct auth path in...

CVE-2026-19538

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...