FreakVulnChecker

FreakVulnChecker 该脚本用于检查你的服务器列表是否接受出口密码套件（Export cipher suites），并可能容易受到 CVE-2015-0204 攻击。 用法 root@kitploit: 用法: ./freak.vuln.check.sh 程序接受单个 ip:port 或域名格式，或者一个 ip 或域名的列表。 它将输出远程服务器接受的出口密码套件（来自本地机器 openssl 二进制文件）。此外，该脚本会将这些信息保存为 CSV 文件。 输出示例 root@kitploit: root@fmt-kali:/FreakVulnChecker...

EUVD-2023-60611

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites TLSECDHERSAWITH3DESEDECBCSHA and TLSRSAWITH3DESEDECBCSHA on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack CVE-2016-2183, which, over very long-lived TLS connections carrying large volumes...

CVE-2023-54356 Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites TLSECDHERSAWITH3DESEDECBCSHA and TLSRSAWITH3DESEDECBCSHA on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack CVE-2016-2183, which, over very long-lived TLS connections carrying large volumes...

CVE-2023-54356 Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites TLSECDHERSAWITH3DESEDECBCSHA and TLSRSAWITH3DESEDECBCSHA on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack CVE-2016-2183, which, over very long-lived TLS connections carrying large volumes...

CVE-2023-54356

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2016-2183), which over very long-lived TLS connections carryi...

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

...

SUSE CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953

A flaw was found in the Erlang/OTP ssl client. This vulnerability allows an on-path attacker to bypass server authentication in TLS 1.2 and earlier and DTLS connections. By tricking the client into accepting an unoffered anonymous cipher suite, the attacker can complete the handshake without a...

Linux Distros Unpatched Vulnerability : CVE-2026-55953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered ...

DEBIAN-CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953

Summary: CVE-2026-55953 affects Erlang/OTP SSL/TLS client when using TLS 1.2 and DTLS. The client fails to verify that the server-chosen cipher suite in ServerHello was among the suites offered in ClientHello. An on-path attacker can respond with a ServerHello using an anonymous cipher suite (e.g...

JLSEC-2026-673

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list ...

CVE-2026-1677

Zephyr sockets created with IPPROTOTLS13 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS e.g. via mbedtlssslconfmintlsversion. The ClientHello advertises both versions and the peer can...

CVE-2026-1677

Zephyr sockets created with IPPROTOTLS13 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS e.g. via mbedtlssslconfmintlsversion. The ClientHello advertises both versions and the peer can...

CVE-2026-1677

Zephyr sockets created with IPPROTOTLS13 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS e.g. via mbedtlssslconfmintlsversion. The ClientHello advertises both versions and the peer can...

CVE-2026-1677 net: TLS 1.2 connections allowed on TLS 1.3 sockets

Zephyr sockets created with IPPROTOTLS13 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS e.g. via mbedtlssslconfmintlsversion. The ClientHello advertises both versions and the peer can...

CVE-2026-1677 net: TLS 1.2 connections allowed on TLS 1.3 sockets

Zephyr sockets created with IPPROTOTLS13 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS e.g. via mbedtlssslconfmintlsversion. The ClientHello advertises both versions and the peer can...

CVE-2026-29129

A flaw was found in Apache Tomcat. This vulnerability occurs when the configured cipher preference order is not preserved. This could allow an attacker to bypass intended security configurations, potentially leading to a weakened security posture or information disclosure. Mitigation Configure...