CVE-2022-3602-and-CVE-2022-3786

CVE-2022-3602-and-CVE-2022-3786 This is a detection script which will determine whether client authentication is required by the SSL server, in which case servers based on OpenSSL 3.0.0 to 3.0.6 will be vulnerable to both CVE-2022-3602 and CVE-2022-3786 Prerequisite's python3 pip install -r...

CVE-2026-71863

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...

EUVD-2026-118497

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...

CVE-2026-71863 SecureDrop: Onion Service client auth credentials copied to Monitor Server

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...

CVE-2026-71863

The SecureDrop whistleblower submission system (versions 2.13.0 through 2.16.1 ) is vulnerable to sensitive data exposure. When running the securedrop-admin install Ansible playbook with journalist alerts disabled, the system leaves the journalist alert key filename empty. This causes a copy task...

1Panel-CVE-2025-54424-

CVE-2025-54424 CVE-2025-54424：1Panel Client Certificate Bypass RCE Vulnerability All-in-One Tool Scan + Exploit Vulnerability Overview 1Panel is an open-source, modern Linux operation and maintenance panel that provides a graphical interface for deploying websites, managing servers, and running...

EUVD-2026-113751

A denial-of-service vulnerability exists in UAA's privatekeyjwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites write access to clien...

PT-2026-133314

A denial-of-service vulnerability exists in UAA's private key jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites write access to...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141779 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP...

Astra Linux – vulnerability in OpenSSL

Issue summary: An unusual configuration of clients utilizing DANE TLSA-based server authentication, combined with atypical server DANE TLSA records, may lead to use-after-free and/or double-free conditions on the client side. Impact summary: Use-after-free can result in various potential...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : RabbitMQ Server vulnerabilities (USN-8933-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8933-1 advisory. It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration...

USN-8933-1: RabbitMQ Server vulnerabilities

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04...

Astra Linux – vulnerability in Erlang

In Erlang/OTP versions prior to 23.3.4.15, 24.x prior to 24.3.4.2, and 25.x prior to 25.0.2, there is a Client Authentication Bypass that occurs under certain client-certification scenarios for SSL, TLS, and DTLS...

Astra Linux – Vulnerability in Golang-1.19

Large handshake records can cause panics in the crypto/TLS context. Both clients and servers may send large TLS handshake records, which can cause both servers and clients to panic when attempting to construct responses. This issue affects all TLS 1.3 clients, TLS 1.2 clients that explicitly enab...

Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. .NET 11 post-handshake TLS client...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the System.Net.Security process. An attacker can bypass mutual TLS client authentication by presenting an invalid or unauthorized client certificate, potentially gaining unauthorized access to resource...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the System.Net.Security process. An attacker can bypass mutual TLS client authentication by presenting an invalid or unauthorized client certificate, potentially gaining unauthorized access to resource...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the System.Net.Security process. An attacker can bypass mutual TLS client authentication by presenting an invalid or unauthorized client certificate, potentially gaining unauthorized access to resource...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/server-legacy is a Frozen v1 SSE transport and OAuth Authorization Server helpers for the Model Context Protocol TypeScript SDK. Deprecated; use StreamableHTTP and a dedicated OAuth server in production. Affected versions of this package are vulnerable to...

BIT-RABBITMQ-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...