4969 matches found
212 New Venezuela Earthquake Domains Prompt Donation Scam Warnings
Researchers spotted 212 new domains registered after Venezuela's earthquake, warning donors of donation scam risks and urging them to verify relief sites first...
Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.
Summary Vulnerabilities have been identified in Apache Log4j Core affecting TLS security and log integrity. The first leaves TLS hostname verification silently ineffective through version 2.25.3, exposing SMTP, Socket, and Syslog appenders to man-in-the-middle attacks. The second introduces CRLF...
Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.
Summary Vulnerabilities have been identified in Apache Log4j Core versions up to 2.25.3 affecting TLS security, log integrity, and XML output handling. The first exposes SMTP, Socket, and Syslog appenders to man-in-the-middle attacks due to silently ineffective hostname verification; the second...
PT-2026-53644
A vulnerability in the handling of verify mode = CERT REQUIRED in the wolfssl Python package wolfssl-py causes client certificate requirements to not be fully enforced. Because the WOLFSSL VERIFY FAIL IF NO PEER CERT flag was not included, the behavior effectively matched CERT OPTIONAL: a peer...
CVE-2026-58054
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This CVE was assigned on the basis that the permission system allows a limited administrator to grant privileges exceeding their own authorization scope, potentially constituting an insecure default...
CVE-2026-58054
CVE-2026-58054 is not a public vulnerability in practice; however, connected details describe a concrete issue in MyBB 1.8.40 where a limited ACP user can assign the Administrators (gid 4) group because verify_usergroup() unconditionally returns true for that group. This enables privilege escalat...
EUVD-2026-39974
MyBB 1.8.40 does not restrict which usergroup a limited Admin Control Panel user may assign when creating or editing users; the user module offers the Administrators group gid 4 and its datahandler's verifyusergroup unconditionally returns true. An admin holding only the delegated user-management...
Linux Distros Unpatched Vulnerability : CVE-2026-53131
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: require Ethernet MAC header before using ethhdr ip6teui64, xtmac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types, and nflogsyslog access...
PT-2026-53086
Name of the Vulnerable Software and Affected Versions MyBB version 1.8.40 Description An issue exists where users with limited Admin Control Panel ACP access can assign any usergroup to an account during creation or editing. This occurs because the verify usergroup function in the user module...
GHSA-8JGF-23Q5-X7XX ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass
Summary ExAws.SNS.verifymessage/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls...
EUVD-2026-39575
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2026:2598-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2598-1 advisory. This update for openssl-3 fixes the following issues - CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String...
Oracle Linux 8 : openssl (ELSA-2026-50323)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50323 advisory. - Fix CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify Resolves: RHEL-180978 - Fix CVE-2024-4741: Use After Free with SSLfreebuffers Resolve...
SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:2621-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2621-1 advisory. This update for openssl-11-livepatches fixes the following issues - CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify bsc1266357. Tenable has...
CVE-2026-6331
HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated...
DEBIAN-CVE-2026-55962
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
CVE-2026-55962
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
CVE-2026-55962
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
CVE-2026-6331
HMAC zero-length tag forgery in EVPDigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated...
