9 matches found
CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...
CVE-2026-105223
The maclof kubernetes-client (versions 0.17.0 before 0.32.0 ) contains a vulnerability where the parseKubeconfig() and parseKubeconfigFile() functions disable TLS certificate verification if a kubeconfig lacks certificate-authority-data. This occurs even when insecure-skip-tls-verify is not set. ...
MAL-2026-14225 Malicious code in ambera (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...
CVE-2026-50578 ePA 3.x Integration: TLS Certificate Verification Universally Disabled
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...
MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...
CVE-2026-4942
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security TLS protocol to a version disabled in the server configuration...
CVE-2026-4434: Improper Certificate Validation
Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification...
CVE-2026-4396: Improper Certificate Validation
Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification...
