PT-2026-64881

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift C++ bindings. This issue involves a wildcard bypass in the matchName function of the TSSLSocket class, failin...

PT-2026-64893

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Apache Thrift Python bindings contain an issue where certificates with host mismatches are not properly validated. Recommendations Upgrade to version 0.24.0...

PT-2026-64880

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification...

RHEL 8 : libreswan (RHSA-2026:46396)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:46396 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1348:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1348:01 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/crypto/ssh: golang:...

PT-2026-64989

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 23.2 through 27.3.4.14 Erlang/OTP version 28.5.0.3 Erlang/OTP version 29.0.3 Description The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake...

AlmaLinux 10 : libreswan (ALSA-2026:46398)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:46398 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service v...

RHEL 10 : libreswan (RHSA-2026:46398)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46398 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

ALSA-2026:46396 Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

SUSE CVE-2026-55990

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...

RLSA-2026:42887 Important: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance X...

RockyLinux 8 : java-17-openjdk (RLSA-2026:42887)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42887 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance...

Improper Certificate Validation

io.netty, netty-handler-ssl-ocsp is vulnerable to Improper Certificate Validation. The vulnerability is due to OcspClient failing to validate that the CertificateID in an OCSP response matches the requested CertificateID, which allows an attacker to replay a legitimately signed GOOD OCSP response...

Linux Distros Unpatched Vulnerability : CVE-2026-59849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured...

Linux Distros Unpatched Vulnerability : CVE-2026-56820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Fina...

Linux Distros Unpatched Vulnerability : CVE-2026-56624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH use...

Linux Distros Unpatched Vulnerability : CVE-2026-17039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path...

Linux Distros Unpatched Vulnerability : CVE-2026-55990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt- provider-cert:' files than there are matching...

GHSA-PPR4-5F46-J9C6 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

Summary When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...