CVE-2026-56684: Use After Free

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

PT-2026-77210

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.33.0 Description The library allows Java and JVM-based applications to interact with RabbitMQ nodes. The functions useSslProtocol and useSslProtocolString within...

Linux Distros Unpatched Vulnerability : CVE-2026-72330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a...

Linux Distros Unpatched Vulnerability : CVE-2026-74270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted...

PT-2026-80227

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

PT-2026-77223

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed vau server pub keys and A...

PT-2026-77603

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromis...

PT-2026-77238

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The ADD CALENDAR handler in defaultmodules/calendar/node helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO...

PT-2026-77143

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.19 Mastodon versions 4.5.0 through 4.5.11 Description When LDAP authentication is configured with LDAP TLS NO VERIFY=true, the file app/models/concerns/user/ldap authenticable.rb mutates...

PT-2026-80452

Assisted Migration Agent: Hardcoded insecure Transport Layer Security TLS connections during vCenter communication in github.com/kubev2v/assisted-migration-agent...

PT-2026-77283

Name of the Vulnerable Software and Affected Versions Lemur versions 0.5.0 through 1.9.2 Description An authenticated non-read-only user can target certificates they do not own or have a role for by using the replaces or replacements identifiers during certificate creation, upload, or edit...

CVE-2026-71308: Authorization Bypass Through User-Controlled Key

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...

Linux Distros Unpatched Vulnerability : CVE-2026-72317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworke...

AlmaLinux 9 : curl (ALSA-2026:55439)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55439 advisory. curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl: Information disclosure via...

PT-2026-80784

Name of the Vulnerable Software and Affected Versions redis versions prior to 8.10.1-1.1 Description Multiple security issues affect the redis package, which is an open source, in-memory database that persists data on disk. Recommendations Update to version 8.10.1-1.1...

PT-2026-77501

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 Description An issue exists in the E1 IOT Orchestrator Security component that allows an unauthenticated attacker with network access via TLS to compromise the...

CVE-2026-27784 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

curl security update

An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...