ROS-20260813-73-0050

The vulnerability of the verifyHostName configuration parameter in the Apache Log4j Core logging library is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack remotely...

CVE-2026-0296: Improper Certificate Validation

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome ...

PT-2026-71379

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect app affected versions not specified Description Improper certificate validation allows an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. MitM is ...

CVE-2026-54481: Improper Certificate Validation

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

PT-2026-71654

Name of the Vulnerable Software and Affected Versions rsync versions 3.2.0 through 3.2.3 rsync-ssl versions prior to 3.4.5 Description A TLS certificate validation issue allows on-path attackers to intercept encrypted sessions by presenting self-signed or invalid certificates. This occurs because...

CVE-2026-70454: Improper Certificate Validation

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome ...

CVE-2026-56624

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

MAL-2026-13891 Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and relat...

MAL-2026-13901 Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and...

Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

MAL-2026-13856 Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fea406c4c8f2da771cb9d9fd8cba41c74520a876454ab9875fbba17c339966d The package's postinstall script callback.js and its main module index.js, loaded on require are byte-identical droppers. On install and on load they...

Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance

Summary The OpenSSL package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42769 Vulnerability Details CVEID:CVE-2026-42769 DESCRIPTION: Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update...

SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:3559-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3559-1 advisory. - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. - CVE-2026-12185:...

CVE-2026-18679: Improper Certificate Validation

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18678: Improper Certificate Validation

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

(Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

This vulnerability allows network-adjacent attackers to bypass certificate validation for OTA updates on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of OTA updates. The issue results from...

Debian dsa-6431 : openjdk-25-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6431 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/securit...

Improper Certificate Validation

Overview org.apache.httpcomponents.client5:httpclient5 is a HttpClient component of the Apache HttpComponents project. Affected versions of this package are vulnerable to Improper Certificate Validation due to the HostnameVerificationPolicyBUILTIN setting having no effect in the async transport. ...