CVE-2026-25651 client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Hos...

CVE-2026-25651 client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect

client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Hos...

CVE-2026-25651

CVE-2026-25651 affects the Node.js middleware client-certificate-auth. Versions 0.2.1 and 0.3.0 contain an open redirect vulnerability caused by unvalidated Host header handling in the HTTP-to-HTTPS redirect (redirecting to https://), enabling attackers to redirect users to arbitrary domains. Pub...

PT-2026-6778

Name of the Vulnerable Software and Affected Versions client-certificate-auth versions 0.2.1 through 0.3.0 Description The software is middleware for Node.js that implements client SSL certificate authentication and authorization. Versions 0.2.1 and 0.3.0 contain an open redirect issue. The...

CLEANSTART-2026-BA37192 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerabili...

CVE-2022-23015

On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase i...

Fixed in Apache Tomcat 11.0.15

Low: Security constraint bypass CVE-2026-24733 Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a specification invalid HEAD...

BIT-NGINX-GATEWAY-2025-23419 TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets...

ROS-20251117-05

A vulnerability in the LXD container and lightweight virtual machine management system is related to redundant API data output. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information The vulnerability in the LXD container and...

GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...

EUVD-2021-27277

Malware in sbrugna...

EUVD-2018-17271

Malware in sbrugna...

EUVD-2018-0794

Malware in sbrugna...

EUVD-2020-3976

Malware in sbrugna...

EUVD-2022-35527

Malicious code in bioql PyPI...

EUVD-2022-28126

Malicious code in bioql PyPI...

EUVD-2025-3168

Malicious code in bioql PyPI...

EUVD-2022-5091

Malicious code in bioql PyPI...

EUVD-2022-1756

Malicious code in bioql PyPI...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the API. An attacker can perform unauthorized actions, such as creating and starting arbitrary instances or executing arbitrary commands inside containers, by tricking a victim authenticated with clien...