PT-2026-79077

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

Malicious code in github-policy-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b8742a99002975ebaced2478673108f4f442e5ac7878651edeb8346702f132 On npm install, the package's postinstall script collects host identifiers os.hostname, platform, arch, node version, package name, npm lifecycle eve...

CVE-2026-75984

TRENDnet TEW-823DRU firmware v1.1.02b01 has a remote command injection flaw in /cgi-bin/admin.cgi: the Hostname argument is passed unsanitized to the shell, allowing low-privileged authenticated attackers to execute arbitrary OS commands. CVSS 3.1 scores it HIGH (7.4). A proof-of-concept script i...

CVE-2026-75984 TRENDnet TEW-823DRU admin.cgi command injection

A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used...

CVE-2026-73563

A flaw was found in the @backstage/plugin-auth-backend component of Backstage. This vulnerability allows an unauthenticated remote attacker to bypass the redirecturi allowlist in the experimental dynamic client registration feature. By crafting a malicious redirect Uniform Resource Identifier URI...

DEBIAN-CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

GHSA-5M9F-RPHJ-C435 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-63336

Prior to 5.33.0, the RabbitMQ Java client's useSslProtocol() methods installed a TrustEverythingTrustManager and disabled hostname verification, accepting any certificate. A network attacker could impersonate the broker, read protected AMQP traffic, and modify it. Fixed in 5.33.0, which uses the ...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection. Mitigation Configure...

PT-2026-77210

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...