cve-2026-105221-gist-tls

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-105221-gist-tls Write-up: https://abraxaslabs.tech/research/cve-2026-105221-gist-tls cve-2026-105221-gist-tls gist RubyGem 6.1.0 - defunkt Class: TLS verify bypass credential theft Reach: Remote on-path...

CVE-2026-32794

CVE-2026-32794: TLS Certificate Verification Bypass in Apache Airflow Databricks Provider Keywords: TLS, certificate verification, MITM, Kubernetes, Databricks, OAuth, CWE-295, Apache Airflow Table of Contents Overview Vulnerability Details Technical Analysis Attack Chain Impact Remediation...

CVE-2026-100835

CVE-2026-100835 — Contrast attestation relay aTLS Python 3 PoC for CVE-2026-100835 — Edgeless SystemsContrast before 1.16.0. Description PoCbit / GitHub CVE-2026-100835 — Remote attestation relay against Contrast attested TLS aTLS CWE-295. Before 1.16.0 , Contrast treated any cryptographically...

curl: HSTS cache file: three trailing dots silently disable HSTS for that host

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...

curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...

curl: wolfSSL TLS sessions retain native-CA trust after the application narrows trust

Summary In curl 8.23.0 with the wolfSSL backend, a TLS session authenticated while the build-default native CA store is active can be resumed after the application changes the same easy handle to a policy that disables native trust. The second transfer succeeds and exchanges HTTP data even though...

CVE-2026-57836-Confluent_Kafka

CVE-2026-57836: confluent-kafka における HashiCorp Vault KMS の TLS 証明書検証の無効化 深刻度: High、CVSS 3.1 7.4 ベクター v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 影響を受けるバージョン: confluent-kafka = 2.8.0, = 2.14.2 修正バージョン: 2.15.0 CWE: CWE-295 不適切な証明書検証 コンポーネント:...

Exploit for CVE-2026-100835

CVE-2026-100835 — Contrast attestation relay aTLS Python 3...

CVE-2026-83964 Adobe Connect | Improper Certificate Validation (CWE-295)

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3. Vulnerability Details CVEID:CVE-2026-42013 DESCRIPTION: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

EUVD-2026-58137

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-48437 CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...

CVE-2026-48437

CVE-2026-48437 affects CAI Content Credentials and is due to Improper Certificate Validation, enabling a security feature bypass and unauthorized write access. Exploitation requires user interaction (victim visits a malicious URL or interacts with a compromised page). CVSS 3.1 base score 5.5 (Med...

CVE-2026-48437 CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...