Lucene search
+L

33 matches found

Kitploit
Kitploit
•added 2026/09/24 6:05 p.m.•19 views

CVE-2026-33752

CVE-2026-33752 CVE-2026-33752 SSRF basado en redirecciones que permite el acceso a la red interna en curlcffi Resumen curlcffi no restringe las solicitudes a rangos de IP internos y sigue las redirecciones automáticamente mediante la librería subyacente libcurl. Debido a esto, una URL controlada...

8.6CVSS6.2AI score0.00446EPSS
SaveExploits1
RedHat Linux
RedHat Linux
•added 2026/09/23 10:13 p.m.•14 views

automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-CA certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•14 views

automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-CA certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•18 views

CVE-2026-84716

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS0.00178EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 7:40 p.m.•40 views

CVE-2026-84716 Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS0.00178EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/09/23 7:40 p.m.•9 views

CVE-2026-84716 Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/23 7:40 p.m.•10 views

EUVD-2026-85611

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References3
CVE
CVE
•added 2026/09/23 7:40 p.m.•19 views

CVE-2026-84716

The automation-controller instance in Red Hat Ansible Automation Platform (versions 2.5, 2.6, and 2.7) contains a flaw in the install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate using the receptor mesh ce...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
•added 2026/09/23 7:15 p.m.•12 views

CVE-2026-84716

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/23 12:00 a.m.•8 views

CVE-2026-84716: Incorrect Privilege Assignment

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

6.6CVSS5.8AI score0.00178EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/09/10 12:00 a.m.•21 views

MikroTik RouterOS 7.0.x < 7.23.4 / 7.24.x < 7.24.2 X.509 Signature Validation Bypass (CVE-2026-67278)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by a certificate validation vulnerability. MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures duri...

9.1CVSS7.3AI score0.00252EPSS
SaveExploits1References4
NVD
NVD
•added 2026/09/05 8:17 p.m.•27 views

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

9.1CVSS0.00252EPSS
SaveExploits1References6
EUVD
EUVD
•added 2026/09/05 8:00 p.m.•16 views

EUVD-2026-72026

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

6.3CVSS7.3AI score0.00252EPSS
SaveExploits1References7
Vulnrichment
Vulnrichment
•added 2026/09/05 8:00 p.m.•26 views

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

6.3CVSS7.3AI score0.00252EPSS
SaveExploits1References6
CVE
CVE
•added 2026/09/05 8:00 p.m.•177 views

CVE-2026-67278

MikroTik RouterOS (7.x branch) is vulnerable to a cryptographic signature verification flaw where it accepts malformed RSA/PKCS#1 v1.5 signatures. Because the trust store includes an e=3 root CA , an attacker who can redirect outbound TLS connections can use the root's public certificate to forge...

9.1CVSS7.3AI score0.00252EPSS
SaveExploits1References6Affected Software1
Cvelist
Cvelist
•added 2026/09/05 8:00 p.m.•54 views

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

6.3CVSS0.00252EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/09/05 12:00 a.m.•28 views

PT-2026-86453

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...

6.3CVSS7.3AI score0.00252EPSS
SaveExploits1References8
OSV
OSV
•added 2026/08/24 1:43 p.m.•9 views

JLSEC-2026-1376

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tlsbuiltin.c, the mgtlsinit function stores the bundle in tls-cabundleder while tls-cader.len remains...

9.3CVSS5.8AI score0.00193EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/20 6:16 p.m.•21 views

CVE-2026-73251

Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tlsbuiltin.c, the mgtlsinit function stores the bundle in tls-cabundleder while tls-cader.len remains...

9.3CVSS0.00193EPSS
SaveExploits0References3
CVE
CVE
•added 2026/08/20 5:41 p.m.•65 views

CVE-2026-73253

Mongoose (embedded web server and network library) prior to version 7.22 is vulnerable to a TLS hostname verification bypass . The root cause is in mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() (in src/tls_builtin.c), which call mg_match() — a function whose wildcard matching can cross DNS...

9.1CVSS7.9AI score0.00344EPSS
SaveExploits1References4Affected Software1
Rows per page
Query Builder