57013 matches found
PT-2026-85155
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...
Linux Distros Unpatched Vulnerability : CVE-2026-78323
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates...
PT-2026-79961
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT PARAMS when LDAP authentication uses LDAP TLS NO VERIFY=true, disabling SSL...
MiracleLinux 9 : kbd-2.4.0-12.el9_8 (AXSA:2026-1640:01)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1640:01 advisory. kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-72693 Tenable has extracted the...
JAR Component DoS
The vulnerability of the JAR component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, is related to a deficiency in the source verification mechanism. Exploiting this vulnerability can allow an attacker to cause service failures...
Unbound DNS Server Unauthorized Access
The vulnerability of the Unbound DNS server is related to deficiencies in the mechanism for verifying data sources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
ROS-20260824-73-0018
Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...
ROS-20260824-73-0019
Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...
ROS-20260824-73-0020
Vulnerability of .NET software platforms and the Microsoft .NET Framework is related to insufficient verification of data authenticity. Exploitation of this vulnerability can allow attackers operating remotely to bypass existing security mechanisms...
Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
...
curl: wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0
Summary When curl is built against wolfSSL, setting CURLOPTSSLVERIFYPEER=0 causes a hostname-mismatched certificate to be accepted even though CURLOPTSSLVERIFYHOST remains at its default enabled setting. I built wolfSSL from source, built curl against it, and connected to a TLS server presenting ...
[SECURITY] Fedora 43 Update: AusweisApp2-2.5.5-1.fc43
The AusweisApp2 is a software to identify yourself online with your ID card Personalausweis or your electronic residence permit Aufenthalts- / Niederlassungserlaubis. The AusweisApp2 also offers you an integrated self-assessment in which you are able to view your data that is stored on the online...
Improper Validation of Certificate with Host Mismatch
Overview io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which...
GHSA-GF32-CMJH-8M9V Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5wp5-5229-5g6q. This link is maintained to preserve external references. Original Description NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader...
Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5wp5-5229-5g6q. This link is maintained to preserve external references. Original Description NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader...
CVE-2026-63310
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
UBUNTU-CVE-2026-63310
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-63310 NLTK before 3.9.3 Missing Post-Download Integrity Verification
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
