PT-2026-60682

Name of the Vulnerable Software and Affected Versions kuma-dp versions 2.8.0 through 2.9.15 Description When kuma-dp is started against an HTTPS control plane without a CA certificate, the data plane connects with TLS peer verification disabled. This causes the dataplane authentication token to b...

PT-2026-60681

Name of the Vulnerable Software and Affected Versions github.com/kumahq/kuma/v2 versions 2.8.0 through 2.9.15 Description When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, the tool disables TLS verification. This causes API tokens to be transmitte...

CVE-2026-46458

creationtimestamp| type| source ---|---|--- 2026-07-15 16:15:07+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-46458...

JLSEC-2026-755 X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A...

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...

JLSEC-2026-723 Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer...

Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension...

JLSEC-2026-738 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA...

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs WOLFSSLTEMPCA added while building a certificate path were previously exempt...

GHSA-2P2F-PX33-4VV5 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Impact The web handler renderMobileBundle internal/web/handlers.go:1325 passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build internal/mobilebundle/builder.go:54, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build never calls...

CVE-2026-40378

Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service LSASS allows an unauthorized attacker to deny service over a network...

CVE-2026-49799

Technical details are not publicly available in the provided documents. No confirmed affected products, fixes, or exploit specifics are described here; monitor official sources for updates.

CVE-2026-49799 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

...

CVE-2026-49799 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

...

CVE-2026-40378 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

...

CVE-2026-40378

CVE-2026-40378 affects Windows Local Security Authority Subsystem Service (LSASS). A memory allocation with an excessive size value can allow an unauthenticated attacker to cause a network-based denial of service. The CVSSv3.1 base score is 7.5 (HIGH). No exploitation details are provided in the ...

CVE-2026-40378 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

...

CVE-2026-49835

A flaw was found in Sigstore Timestamp Authority. An unauthenticated remote attacker can exploit this vulnerability by sending requests with arbitrary HTTP paths and methods. This leads to the creation of an excessive number of unique metric labels, causing unbounded memory growth and a denial of...

Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service LSASS allows an unauthorized attacker to deny service over a network...

Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service LSASS allows an authorized attacker to deny service over a network...

CVE-2026-6790

In Eclipse Jetty, HTTP/1 requests to HTTP/1.3 (HTTP/2/3 included) do not enforce that the request authority (host and port) matches the Host header when present. This mismatch can affect URI redirects, virtual host selection, reverse proxying, and logs. The issue is described across CVE sources (...

EUVD-2026-43573

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3EXTd2iext returns NULL when an extension's DER value fails to parse. basicC, ia5string, and authatt dereference its result without a NULL check. keyiddata also dereferences akid-keyid,...

PT-2026-60097

Name of the Vulnerable Software and Affected Versions nebula-mesh affected versions not specified Description The web handler renderMobileBundle passes a pki.CAResolver to the mobilebundle.Build function, which decrypts the CA's ed25519 private key into a pki.CAManager. However, the Build functio...