CLEANSTART-2026-WX29225 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CVE-2026-113812

A flaw was found in Mozilla::CA. The Certificate Authority CA bundle includes a root certificate linked to compromised intermediate certificates. A remote attacker capable of intercepting or redirecting network traffic could exploit this flaw using the compromised keys to impersonate a Transport...

Linux Distros Unpatched Vulnerability : CVE-2026-107705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash that allows attackers controlling the password to overwrite stac...

CVE-2026-113470

A flaw was found in Firefox. When dynamic updates for certificate revocation lists are disabled or unavailable, the browser relies on built-in data that fails to block certain compromised intermediate Certificate Authority CA certificates. A remote attacker could exploit this flaw using fraudulen...

CVE-2026-43854

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

CVE-2026-43854

A vulnerability exists that could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices . No specific software versions, root causes, or remediation steps are provided in the documents. Exploitation details are not provided.

CVE-2026-43854

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

cve-2017-7374

cve-2017-7374 To trigger the vulnerability, we need a ext4 file system with encryption support and create a encrypted directory...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

CVE-2026-105810

The TP-Link Tapo C320WS V2.0 is vulnerable to an authenticated stack-based buffer overflow within the local onboarding Wi-Fi configuration path. An authenticated attacker located on the adjacent network can submit a crafted request featuring an oversized encrypted password field to overwrite the ...

undici: undici: Certificate validation bypass via dropped TLS options in Agent

A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security TLS verification functions during...

undici: undici: Certificate validation bypass via dropped TLS options in Agent

A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security TLS verification functions during...

CVE-2026-111748: Reliance on Untrusted Inputs in a Security Decision

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

antnium

Antnium Anti Tanium A C2 framework and RAT written in Go. This source code is publicly published as reference for my presentation Develop your own RAT - AV & EDR Defense. Antnium inteded to fulfill my own requirements, and not those of others. Works for the campaigns i performed, but is not...

EUVD-2026-102301

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

Astra Linux – Vulnerability in edk2

The example of an encrypted private key in EDK2, present in the IpSecDxe.efi, may pose potential security risks...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Improved error handling for ext4dirhash The ext4dirhash function almost never fails, especially since the “hash tree” feature was first introduced. However, with the addition of support for encrypted, case-folded file names...

Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed the issue of waiting for block writeback in the postread case. If the inode is compressed but not encrypted, the function f2fswaitonblockwriteback was not called properly, resulting in waiting for the GC-ed page...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...