BIT-RABBITMQ-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

BIT-LIBPHP-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CLEANSTART-2026-PL27634 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the docker-cli-buildx package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2026-TJ01241 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Security vulnerability affects the cri-tools package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate...

CLEANSTART-2026-RI58790 Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

Security vulnerability affects the cri-tools package. Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method...

CLEANSTART-2026-MQ17226 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the cri-tools package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

thrift: thrift: Information disclosure via improper certificate validation in Perl bindings

A flaw was found in Apache Thrift's Perl bindings. Due to insecure default settings and improper certificate validation, client connections fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could exploit this vulnerability to...

thrift: thrift: Man-in-the-middle attacks via improper certificate validation

A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...

CLEANSTART-2026-YV91270 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

CVE-2026-32281 affects multiple packages. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details...

CLEANSTART-2026-FP06754 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Security vulnerability affects the cri-tools package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate...

CLEANSTART-2026-WD31763 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

Security vulnerability affects the kube-state-metrics-fips package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second facto...

nodejs:24 security, bug fix, and enhancement update

An update is available for module.nodejs, module.nodejs-nodemon, nodejs-packaging, module.nodejs-packaging, nodejs-nodemon, nodejs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS...

PT-2026-103953

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...

PT-2026-103947

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 1.1.35 Description The buildWSLegacyExecutor function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using t...

CVE-2026-103921: Improper Certificate Validation

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

PT-2026-105148

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

AlmaLinux 9.2 [TuxCare] Security Update: perl-HTTP-Tiny (ALMALINUX9.2:CLSA-2025:1759496747)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759496747 advisory. - HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where...

Rocky Linux 8 [CIQ] Security Update: grilo / grilo-debuginfo / grilo-debugsource / grilo-devel (crlsa-2021_4339)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214339 advisory. grilo: missing TLS certificate verification CVE-2021-39365 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2026:1774431936)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1774431936 advisory. - Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49,...