BIT-RABBITMQ-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

BIT-LIBPHP-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

BIT-LIBPHP-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

safe-check-CVE-2025-23419

Safe Check CVE-2025-23419 - NGINX mTLS Session Resumption Repositório com script de validação segura para a CVE-2025-23419 , vulnerabilidade relacionada ao NGINX , mTLS e TLS session resumption. 包含安全验证脚本的仓库，用于 CVE-2025-23419 ，该漏洞涉及 NGINX 、mTLS 和 TLS session resumption 。 O script realiza uma...

CVE-2026-23918-Passive-Audit

CVE-2026-23918 审计脚本 或者，你也可以直接 curl 请求头快速瞄一眼，但接下来要登场的是： 用于 Apache HTTP Server 的非侵入式 HTTP 元数据审计工具 CVE-2026-23918（https://www.openwall.com/lists/oss-security/2026/05/04/19）暴露评估。 该工具发送普通 HTTP HEAD/GET 请求，并执行 TLS ALPN 协商以观察 HTTP/2 支持情况。 环境要求 Python 3.13 或更高版本 uv 安装 uv： curl -LsSf...

CLEANSTART-2026-PU86429 During the TLS 1

Security vulnerability affects the cri-tools package. During the TLS 1...

AndroidAuto

Open Android Auto Android Auto 手机端 应用的开源实现。此应用在手机上运行，通过USB将画面投射到汽车头机，替代Google专有的 com.google.android.projection.gearhead APK。 ⚠️ 正在进行中 本项目处于早期开发阶段。协议握手和视频投影已在真实头机上成功运行。手机屏幕可在汽车头机上成功显示约几秒钟后断开（视频稳定性正在改进）。 功能 协议与连接 USB AOA 附件模式检测与连接 TLS 1.2 双向认证（手机作为服务器） 版本协商（协议 v1.7） 服务发现（请求/响应）...

CLEANSTART-2026-NB75490 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Security vulnerability affects the cri-tools package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed...

RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

AlmaLinux 9.2 [TuxCare] Security Update: perl-HTTP-Tiny (ALMALINUX9.2:CLSA-2025:1759496747)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759496747 advisory. - HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779120418)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779120418 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782832840)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782832840 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2021_4059)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214059 advisory. curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols CVE-2021-22946 curl: Server responses received before STARTTLS process...

PT-2026-103973

Name of the Vulnerable Software and Affected Versions confluent-kafka-python versions prior to 2.15.1 Description Improper TLS certificate validation in the HashiCorp Vault KMS integration may allow a remote attacker to obtain sensitive information. TLS Transport Layer Security is a cryptographic...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_74085)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_73838)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673838 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

RockyLinux 10 : nodejs24 (RLSA-2026:73428)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73428 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

RockyLinux 8 : nodejs:24 (RLSA-2026:74085)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783342928)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783342928 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...