EUVD-2026-87923

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102 OCSP stapling v2 multi accepts non-CA chain certificates as issuers

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102

WolfSSL versions 5.7.2 through 5.9.2 contain a client-side implementation flaw in RFC 6961 regarding multiple OCSP response stapling. When the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature is enabled and the client calls wolfSSL_UseOCSPStaplingV2 with WOLFSSL_CSR2_OCSP_MULTI , the client fails to ve...

CVE-2026-89102: Improper Certificate Validation

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-67231

RabbitMQ (messaging and streaming broker) is vulnerable to a TLS client-authentication bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. When the trust-store plugin is enabled and used as the verify_fun, the system improperly validates certificates by matching only the Issuer...

PT-2026-97583

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the trust-store plugin where the verify fun...

PT-2026-95358

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the Online Certificate Status Protocol OCSP Client, which is a protocol used for obtaining the real-time revocation status of digital certificates. The client fails to verify t...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-85175

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

EUVD-2026-70410

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175

SiYuan versions ≤ 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict the TLS private key (conf/key.pem) and CA private key (conf/ca.key). Because the getFile handler skips the ...

PT-2026-85007

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description An incomplete blocklist in the IsForbiddenAbsPath function kernel/util/path guard.go fails to restrict access to the TLS private key conf/key.pem and the CA private key conf/ca.key within the conf/...

SUSE SLES15 Security Update : erlang (SUSE-SU-2026:3645-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3645-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

Security update for erlang

This update for erlang fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

SUSE-SU-2026:3645-1 Security update for erlang

This update for erlang fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...

CVE-2026-74882

openssl_encrypt versions before 1.4.0 ship with an insecure default in its IntegrityProxyConfig trusted_proxies that trusts the entire RFC 1918 private address space. This allows attackers on private networks to forge client certificate headers and bypass mTLS authentication when ProxyAuth valida...

SUSE SLES15 Security Update : erlang26 (SUSE-SU-2026:3579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3579-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

Security update for erlang26

This update for erlang26 fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...