Oracle Linux 10 : perl-URI (ELSA-2026-84587)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84587 advisory. 5.27-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via...

ALSA-2026:84587 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

ALSA-2026:84588 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

RHEL 10 : perl-URI (RHSA-2026:84587)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84587 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated b...

RHEL 8 : perl-URI (RHSA-2026:84590)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84590 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated by...

AlmaLinux 10 : perl-URI (ALSA-2026:84587)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84587 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

AlmaLinux 8 : perl-URI (ALSA-2026:84590)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84590 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

RHEL 9 : perl-URI (RHSA-2026:84588)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84588 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated by...

Oracle Linux 9 : perl-URI (ELSA-2026-84588)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84588 advisory. 5.09-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

The Coder software versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 are vulnerable to a credential theft flaw. The root cause is an improper hostname validation in GetWorkspaceProxyByHostname, where a SIMILAR TO pattern performs a prefix match . This ...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

EUVD-2026-103294

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927: Insufficiently Protected Credentials

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

PT-2026-116495

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.20 Coder versions 2.33.0 through 2.33.11 Coder versions 2.34.0 through 2.34.7 Coder versions 2.35.0 through 2.35.3 Description An improper hostname validation flaw exists in the GetWorkspaceProxyByHostname function...

Important: gnutls

Issue Overview: A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate. CVE-2026-88647 Affected Packages: gnutls Issue Correction: Run dnf update gnutls --releasever...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2026-3238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3238 advisory. A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate. CVE-2026-88647 Tenable has...

CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...