CVE-2026-115758

In SumatraPDF version 3.6.1 and earlier for Windows, the HttpGet() function in src/base/Http_win.cpp incorrectly passes the INTERNET_FLAG_IGNORE_CERT_CN_INVALID flag to WinINet . This configuration disables hostname matching for HTTPS update metadata and crash-symbol requests while maintaining ce...

CVE-2026-115758 SumatraPDF: TLS hostname validation disabled in `HttpGet()`

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet in src/base/Httpwin.cpp unconditionally passes INTERNETFLAGIGNORECERTCNINVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

CVE-2026-34207

CVE-2026-34207 The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets. Intro I found this issue while reviewing Typebot , an open-source chatbot builder, with a...

MemorizingTrustManager

MemorizingTrustManager - Private Cloud Support for Your App MemorizingTrustManager MTM is a project to enable smarter and more secure use of SSL on Android. If it encounters an unknown SSL certificate, it asks the user whether to accept the certificate once, permanently or to abort the connection...

CVE-2026-78850

Matomo Authenticated SiteContentDetector Blind SSRF Reporter Name: CYBER-SEC Contact: [email protected] Summary Matomo allows an authenticated site administrator to configure a site's mainurl with an internal address. Any authenticated user with view access can later trigger...

CVE-2026-106036 Improper certificate validation in Szafir

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

Safir encryption issue vulnerability in the National Accounting Office

The KRAI Krajowa Izba Rozliczeniowa version 2.0 and earlier contain an encryption vulnerability stemming from the failure to perform certificate and hostname validation. This allows arbitrary client or server certificates to be accepted, potentially enabling attackers to supply any SSL/TLS...

Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026

On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The...

Node.js 26.12.1 TLS Certificate Hostname Bypass Check

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain a TLS certificate hostname validation flaw involving non-canonical IPv4 literals. This offline tool assesses operator-supplied Node.js version evidence against the fixed releases...

Node.js 26.12.0 TLS Hostname Validation Bypass

A Python tool evaluates operator-reported Node.js version evidence for a TLS hostname validation bypass caused by fullwidth IPv4 digits...

Node.js TLS Fullwidth-IP Hostname Validation Bypass

Node.js versions 24.x and 26.x contain a TLS hostname validation bypass when an IPv4 host uses fullwidth digits...

Exploit for CVE-2026-105483

node-cve-2026-105483-check Standalon...

Node.js Node encryption issues vulnerability

Versions 22.23.3 and earlier of Node.js, 24.22.0 and earlier, and 26.12.0 and earlier contain an encryption-related vulnerability stemming from improper TLS hostname validation. Specifically, tls.checkServerIdentity fails to recognize non-standard IPv4 hostname formats as valid IP addresses;...

Node.js Node encryption issues vulnerability

Versions 22.23.3 and earlier of Node.js, 24.22.0 and earlier, and 26.12.0 and earlier contain an encryption vulnerability stemming from a flaw in TLS hostname validation: when the host is an invalid IPv4 address with a leading zero e.g., 0127.0.0.1, tls.checkServerIdentity interprets the leading...

Node.js Node encryption issues vulnerability

Node.js versions 24.22.0 and earlier, as well as 26.12.0 and earlier, contain an encryption-related vulnerability. This vulnerability arises because TLS hostname validation fails to treat hostnames containing non-ASCII characters—such as full-width digits—as IP addresses; instead, it matches them...

CLSA-2026-1776878817 squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

Astra Linux – vulnerability in freerdp3

FreeRDP versions prior to 3.29.0 affected versions ≤ 3.28.0 contain an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats wildcard patterns such as .example.com as matching any hostname ending in .example.com;...