8143 matches found
Toward Secure Web to ERP Payment Flows: A Case Study of HTTP Header Trust Failures in SAP Based Systems
Electronic banking portals often sit in front of enterprise resource planning ERP systems such as SAP, mediating payment requests between users and back end financial infrastructure. When these integrations place excessive trust in client supplied HTTP metadata, subtle design flaws can arise that...
PT-2026-25564
These vulnerabilities matter because they target the trust boundary of development tools. A crafted object file can crash your debugger CVE-2026-2341 or potentially execute code CVE-2025-11495. Read more: 👉 https://t.co/eePbxfrCYi Security Fedora https://t.co/6gh3G5nd2g...
GHSA-99QW-6MR3-36QR OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
Summary OpenClaw automatically discovered and loaded plugins from .openclaw/extensions/ inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory...
AI-HealthTech Innovator Humata Health Partners with AccuKnox for Zero Trust CNAPP
Menlo Park, California, USA, 13th March 2026, CyberNewswire...
JumpServer 信任管理问题漏洞
JumpServer is an open-source bastion host provided by JumpServer Technology Co., Ltd. in Hangzhou, China. Versions of JumpServer prior to v4.10.16-lts contained a vulnerability related to trust management. This vulnerability stemmed from improper validation of the custom SMS API client certificat...
cpp-httplib 信任管理问题漏洞
cpp-httplib is a C++ library developed by Yhirose, designed for HTTP/HTTPS servers and clients. Prior to version 0.37.2 of cpp-httplib, there was a vulnerability related to trust management. This vulnerability occurred when a client configured a proxy and enabled setfollowlocation, causing TLS...
PT-2026-29228
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12 Description OpenClaw automatically discovers and loads plugins from the .OpenClaw/extensions/ directory without explicit trust verification. This allows for arbitrary code execution, as attackers can includ...
GO-2026-4673 Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go in github.com/arslanbekov/terraform-provider-sendgrid
Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go in github.com/arslanbekov/terraform-provider-sendgrid...
GHSA-4CM8-XPFV-JV6F ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
Summary The email channel authorizes senders based on the parsed From header identity only. If upstream email authentication/enforcement is weak for example, relaxed SPF/DKIM/DMARC handling, an attacker can spoof an allowlisted sender address and have the message treated as trusted input. Details...
Trane多款产品 信任管理问题漏洞
Trane Tracer SC, among others, are products of the American company Trane. Trane Tracer SC is a building controller for monitoring and automation management. Trane Tracer SC+ is also a building controller for monitoring and automation management. Trane Tracer Concierge is a building management...
NEXULEAN 信任管理问题漏洞
NEXULEAN is a personal work collection and service display platform created by Stalin, a cybersecurity professional. Versions of NEXULEAN prior to 2.0.0 had vulnerabilities related to trust management. These vulnerabilities stemmed from the exposure of Firebase and Web3Forms API keys, allowing...
kernel: x86/tdx: Fix "in-kernel MMIO" check
A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...
GHSA-J443-WCQQ-XPRH Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go
Summary A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version. If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted...
Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go
Summary A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version. If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted...
HMS eWON Firmware 信任管理问题漏洞
HMS eWON Firmware is an embedded device firmware developed by the Swedish company HMS. Versions 12.2 to 13.0 of HMS eWON Firmware contain vulnerabilities related to trust management. These vulnerabilities stem from an authentication bypass in the wsdReadForm endpoint, which could allow attackers ...
Dell Alienware Command Center 信任管理问题漏洞
Dell Alienware Command Center is a software package manager developed by the American company Dell. Versions of the Dell Alienware Command Center prior to 6.12.24.0 contained a vulnerability related to trust management. This vulnerability stemmed from improper certificate verification, which coul...
Micro Research MR-GM5L-S1和Micro Research MR-GM5A-L1 信任管理问题漏洞
Both Micro Research MR-GM5L-S1 and Micro Research MR-GM5A-L1 are embedded industrial communication module devices produced by the Canadian company Micro Research. Both devices have vulnerabilities related to trust management. These vulnerabilities stem from the use of hardcoded credentials, which...
BIT-ZOOKEEPER-2026-24281 Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must...
