CVE-2026-81034: Improper Certificate Validation

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

PT-2026-82222

Name of the Vulnerable Software and Affected Versions Netmaker affected versions not specified Description Netmaker disables certificate verification when connecting to the configured mail server. In the file pro/email/smtp.go, the sender assigns a TLS configuration where the skip-verify field is...

PT-2026-82220

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

ALSA-2026:60304 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

ALSA-2026:60306 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

CVE-2026-19538: Authentication Bypass by Spoofing

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

PT-2026-82048

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

Mongoose TLS Man-in-the-Middle

The vulnerabilities of the functions mgtlsverifycertsan and mgtlsverifycertcn in the src/tlsbuiltin.c file of the Mongoose library are related to errors in the certificate validation process. Exploiting these vulnerabilities could allow a remote attacker to perform “man-in-the-middle” attacks...

RHCOS 4 : OpenShift Container Platform 4.16.69 (RHSA-2026:56852)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56852 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

MiracleLinux 9 : java-25-openjdk-25.0.4.0.7-1.1.el9.ML.1 (AXSA:2026-1651:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1651:08 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

RHCOS 4 : OpenShift Container Platform 4.14.72 (RHSA-2026:56785)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56785 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

MiracleLinux 8 : java-17-openjdk-17.0.20.1.1-1.1.el8 (AXSA:2026-1669:15)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1669:15 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...

RHEL 10 : golang (RHSA-2026:60306)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60306 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:60305)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60305 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1:...

SUSE SLES15: kernel-livepatch-6_4_0-150600_23_73-default / etc (SUSE-SU-2026:3704-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3704-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.73 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15: kernel-livepatch-6_4_0-150600_23_81-default / etc (SUSE-SU-2026:3748-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3748-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.81 fixes various security issues: The following security issues were fixed: -...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098868)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098868 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the...

openssl: openssl: Denial of Service via race condition in certificate extension caching

A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service DoS by initiating concurrent connections to a multi-threaded Transport Layer Security TLS client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously...