PT-2026-74549

TuxCare rebuilt https-proxy-agent to address 2 CVEs. Fixed in 1.0.0-tuxcare.1...

PT-2026-67674

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598

CVE-2026-67598 affects Emlog Pro up to version 2.6.23. The TLS certificate verification is disabled in include/service/ai.php via CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST across sendStream(), sendImageRequest(), send(), and fetchSearchHtml(), with no option to re-enable verification. Thi...

CVE-2026-43373

creationtimestamp| type| source ---|---|--- 2026-08-03 07:03:30+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...

CVE-2026-67352

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

EUVD-2026-51867

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-67352 luci-app-https-dns-proxy Stored XSS via resolver_url

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-58178

creationtimestamp| type| source ---|---|--- 2026-08-01 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryu6dkplb2v...

PT-2026-67325

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-67352: Improper Neutralization of Input During Web Page Generation

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-16504

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

EUVD-2026-51548

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-63220

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

CVE-2026-63220

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

EUVD-2026-51313

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

VPS.org one-click deployment templates contain multiple vulnerabilities

Overview VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures. Description VPS.org is a cloud and virtual private server hosting provider that offer...

CVE-2026-63220: Use of Less Trusted Source

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

SUSE CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...