EUVD-2026-68038

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

EUVD-2025-210810

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

EUVD-2025-210809

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

PT-2026-83496

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.7 Description An authentication bypass exists due to the mo saml login validate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse int...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is...

CVE-2026-55856

MariaDB Connector/J (Java connector for MariaDB/MySQL databases) has a cleartext password disclosure vulnerability on the initial-handshake path. When an application connects with sslMode=verify-full or verify-ca, supplies a password, and does not configure serverSslCert or trustStore, the connec...

CVE-2026-55856 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-81518

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2025-64649

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-36290

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-64649

IBM Concert versions 1.0.0 through 2.3.1 are affected by improper certificate validation , allowing a remote attacker to perform unauthorized actions via man-in-the-middle techniques. The vulnerability carries a CVSS 3.1 score of 5.9 (MEDIUM) with a high attack complexity, no privileges required,...

CVE-2025-64649 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 contain a vulnerability in the JWT service component (apjwtservice.py module), where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. This allows a remote attacker to perform man-in-the-middle a...

CVE-2026-75122

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...