CVE-2026-16822

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have improper certificate validation allowing a remote attacker (no auth needed) to impersonate the TNC policy server and modify traffic; CVSS 9.3 Critical. IBM support page linked as reference; no patch or exploit details provided in documents.

EUVD-2026-62705

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation...

CVE-2026-16835 Power System Improper Certificate Validation

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...

CVE-2026-15078 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates...

EUVD-2026-62428

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates...

CVE-2026-15078 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates...

CVE-2026-15078

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 NIM fail to properly validate TLS certificates, allowing a remote attacker with low privileges to bypass authentication and gain unauthorized access. CVSS 3.1 scores this HIGH (8.1) with full confidentiality and integrity impact. IBM PSIRT is the reporting sou...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...

PT-2026-78789

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user with the ability to intercept network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server can access or modify data exchanged...

ALSA-2026:57126 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate...

RHEL 10 : yggdrasil (RHSA-2026:57126)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57126 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

PT-2026-78590

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper certificate validation allows a remote attacker to impersonate the TNC policy server and modify network traffic. Recommendations At the moment, there is no...

PT-2026-78430

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Network Installation Management NIM contains a flaw where TLS certificates are not properly validated. This could allow a remote attacker to gain unauthorized access to AIX...

GHSA-5CFW-78WC-WVJQ vulnerabilities

Vulnerabilities for packages: libcrypto3-2.34, openssl, eco-python-openssl...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

DEBIAN-CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-52723

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

EUVD-2026-61055

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

CVE-2026-52723 ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...