PT-2026-60652

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

CVE-2026-15925: Improper Validation of Certificate with Host Mismatch

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

RHEL 8 : nodejs:24 (RHSA-2026:39868)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39868 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

PT-2026-60425

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.1 Snowflake Connector for Python versions prior to 3.18.1 Description Improper TLS hostname verification allows a network-positioned attacker to bypass certificate hostname validation on HTT...

CVE-2026-56454: Use of a Broken or Risky Cryptographic Algorithm

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1...

CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

CVE-2026-12382

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-12382

The CVE-2026-12382 issue affects the AAP Gateway Envoy proxy. The non-mTLS route to EDA event streams fails to remove the Subject header despite requestHeadersToRemove, allowing an unauthenticated attacker to spoof a Subject header that matches a legitimate client certificate DN and bypass mTLS t...

EUVD-2026-44739

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-12382 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

CVE-2026-12382

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

USN-8553-1 dotnet8, dotnet10 vulnerabilities

Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. CVE-2026-47300 Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issu...

USN-8553-1: .NET vulnerabilities

Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. CVE-2026-47300 Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issu...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...