38444 matches found
MAL-2026-14338 Malicious code in proc_macro1 (crates.io)
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...
PT-2026-79077
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...
Malicious code in proc_macro1 (crates.io)
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...
CVE-2026-76403
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol HTTP Event Collector in Splunk Enterprise. The vulnerability...
CVE-2026-76362
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...
CVE-2026-76403 Improper Certificate Validation through HTTP Event Collector Kerberos Authentication in Splunk Connect for Kafka
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol HTTP Event Collector in Splunk Enterprise. The vulnerability...
CVE-2026-76403
Splunk Connect for Kafka versions below 2.2.7 are affected by an improper certificate validation flaw in the Kerberos authentication path . When Kerberos is used with the HTTP Event Collector in Splunk Enterprise, the HTTP client is built without applying the configured certificate validation opt...
CVE-2026-76385 Information Disclosure through Action Parameters in Venafi app for Splunk SOAR
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in...
CVE-2026-76362
Splunk SOAR versions below 8.6.0 fail to verify CyberArk REST server certificates by default, allowing an attacker with network-path interception capability between SOAR and the CyberArk server to read or modify all credential-manager traffic. CVSS 7.4 HIGH (network attack, no auth). Remediation ...
CVE-2026-76362 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability is...
CVE-2026-16837
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...
CVE-2026-16822
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation...
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
Important: Red Hat Security Advisory: yggdrasil security update
An update for yggdrasil is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
CVE-2026-16837
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1, mishandle a missing SSL client certificate, allowing an unauthenticated remote attacker to trigger denial of service. CVSS 3.1 scores this HIGH (7.5), with no confidentiality or integrity impact. No patch or exploitation details are provided in the docum...
EUVD-2026-62726
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...
CVE-2026-16837 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...
CVE-2026-16822 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation...
CVE-2026-16822
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have improper certificate validation allowing a remote attacker (no auth needed) to impersonate the TNC policy server and modify traffic; CVSS 9.3 Critical. IBM support page linked as reference; no patch or exploit details provided in documents.