EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

PT-2026-100027

Security vulnerability affects the cert-manager-webhook-pdns-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100025

Security vulnerability affects the cert-manager-webhook-pdns-fips package. This issue is resolved in later releases. See references for vulnerability details...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

PT-2026-99825

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

GHSA-5MQ7-RWHJ-4FH9 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through the UseCertificateAuthorization flow in Authorization.Certificate, specifically the AddOrgAndSpacePolicies authorization path that trusts the X-Client-Cert header. An attacker can bypass SameOrg a...

CVE-2026-81868

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868: Authentication Bypass Using an Alternate Path or Channel

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

PT-2026-94384

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate provided in the X-Client-Cert request header without...

tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized...

CVE-2026-27564

creationtimestamp| type| source ---|---|--- 2026-09-16 07:56:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/117279648543638927 2026-09-16 07:57:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mvmo3krdbfq2 2026-09-16 07:57:38+00:00| seen|...

CVE-2026-27563

creationtimestamp| type| source ---|---|--- 2026-09-16 07:56:59+00:00| seen| https://infosec.exchange/users/certvde/statuses/117279648543638927 2026-09-16 07:57:06+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mvmo3krdbfq2 2026-09-16 07:57:38+00:00| seen|...