nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections

A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security TLS servers, An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response...

Exploit for CVE-2026-30741

Security Advisory: CVE-2026-30741 Product: OpenClaw Agent Pla...

CLSA-2026-1773137907 nginx: Fix of CVE-2026-1642

CVE-2026-1642: fix upstream TLS proxy vulnerability allowing MITM inject plaintext into proxied responses; enforce strict upstream TLS verification and reject injected plaintext...

EUVD-2026-10344

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...

CVE-2026-29023

CVE-2026-29023 affects Keygraph Shannon’s router component. A hard-coded API key in the router configuration enables network attackers to authenticate if the router port is reachable, allowing them to proxy requests through the Shannon instance using the victim’s configured upstream provider API ...

CVE-2026-29023 Keygraph Shannon Hard-coded Router API Key

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...

CVE-2026-29023

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...

CVE-2026-29023 Keygraph Shannon Hard-coded Router API Key

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...

PT-2026-24097

Name of the Vulnerable Software and Affected Versions Keygraph Shannon affected versions not specified Description Keygraph Shannon contains a hard-coded API key within its router configuration. When the router component is enabled and accessible, network attackers can use this publicly known key...

Fedora 44 : python-asyncmy (2026-cd9be7f17c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cd9be7f17c advisory. This is an upstream security and bugfix release. For details, see the release notes. Tenable has extracted the preceding description block directly from the...

openSUSE 16 Security Update : freerdp2 (openSUSE-SU-2026:20320-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20320-1 advisory. Changes in freerdp2: - Multiple CVE fixes: CVE-2026-24491, bsc1257981, CVE-2026-24675, bsc1257982, CVE-2026-24676, bsc1257983, CVE-2026-24679,...

AI Gateway secret API accepts `$ENV_VAR` references and can be remotely abused to exfiltrate server-side environment credentials to an attacker-controlled upstream endpoint. And the leaked credentials can be further leveraged to break security boundaries.

Analyzed project versions: Current target branch: master Current HEAD: dc8ef3cbbefccf7384f4e3023492aae635c5d5d0 Fix 403 Forbidden for artifact list via query param when defaultpermission=NOPERMISSIONS 21220, commit date: 2026-03-04 The vulnerability is that AI Gateway secrets allow...

OPENSUSE-SU-2026:20320-1 Security update for freerdp2

This update for freerdp2 fixes the following issues: Changes in freerdp2: - Multiple CVE fixes: CVE-2026-24491, bsc1257981, CVE-2026-24675, bsc1257982, CVE-2026-24676, bsc1257983, CVE-2026-24679, bsc1257986, CVE-2026-24681, bsc1257988, CVE-2026-24682, bsc1257989, CVE-2026-24683, bsc1257990,...

CLSA-2026-1772645765 Update of alt-php

New microcode update packages from upstream up to 2026-02-21: - Addition AMD CPU microcode for processor family 0x1a: cpuid:0x00B00F21ver:0x0B002161, cpuid:0x00B00F81ver:0x0B008121, cpuid:0x00B10F10ver:0x0B101058, cpuid:0x00B20F40ver:0x0B204037, cpuid:0x00B40F40ver:0x0B404035,...

nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections

A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security TLS servers, An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response...

kernel security update

5.14.0-611.36.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Fedora 43 : firefox (2026-766e3a6ec8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-766e3a6ec8 advisory. - New upstream release 148.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

CVE-2026-27896

A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 specification, which explicitly requires case-sensitive...

kernel security update

6.12.0-124.39.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security update

5.14.0-611.35.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...