EulerOS 2.0 SP10 : ca-certificates (EulerOS-SA-2026-3731)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

EulerOS Virtualization 2.11.1 : ca-certificates (EulerOS-SA-2026-3406)

According to the versions of the ca-certificates package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying...

EulerOS Virtualization 2.11.0 : ca-certificates (EulerOS-SA-2026-3493)

According to the versions of the ca-certificates package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying...

PT-2026-99978

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

EulerOS 2.0 SP10 : ca-certificates (EulerOS-SA-2026-3683)

According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...

Incorrect Permission Assignment for Critical Resource

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the tls module. An attacker can modify the process-wide certificate authorities by invoking...

CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...

AZL-103098 CVE-2026-91992 affecting package python-tornado 6.3.3-11

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992

A flaw was found in Tornado's CurlAsyncHTTPClient. This vulnerability occurs because pycurl handles are reused across requests without proper state clearing. A remote attacker can exploit this by issuing requests through the same client instance, leading to the unintended persistence of sensitive...

EUVD-2026-78664

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

SUSE CVE-2023-32803

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 AL2 does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491...

CVE-2026-91992: Exposure of Sensitive Information to an Unauthorized Actor

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

PT-2026-98962

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

Astra Linux – Vulnerability in Node.js

If the Node.js HTTPS API was used incorrectly, and “undefined” was passed as the “rejectUnauthorized” parameter, no error would be returned, and connections to servers with expired certificates would be accepted...

Astra Linux – Vulnerability in mbedtls

In Mbed TLS versions prior to 2.28.10, and 3.x versions prior to 3.6.3, on the client side, servers with trusted certificates for arbitrary hostnames are accepted, unless the TLS client application calls mbedtlssslsethostname...

Astra Linux – Vulnerability in nss, Thunderbird

Versions of NSS Network Security Services prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications that use NSS to handle signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be affected. Applications that...

Astra Linux – Vulnerability in Twisted

In words.protocols.jabber.xmlstream in Twisted through version 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to intercept connections...

Astra Linux – Vulnerability in vsftpd

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers that implement different protocols but use compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker, who has access to the victim’s traffic at the TCP/IP layer, can redirect...

Astra Linux – Vulnerability in Bouncycastle

The Bouncy Castle For Java version prior to 1.74 is affected by an LDAP injection vulnerability. This vulnerability only affects applications that use the LDAP CertStore provided by Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the...