9435 matches found
CVE-2026-58040: Improper Validation of Certificate with Host Mismatch
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
PT-2026-66408
Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Node.js HTTPS Agent connection reuse mechanism can lead to PFX object-array key collisions. This issue allows mutual TLS mTLS client identities to be...
CVE-2026-56850: Improper Authentication
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
CVE-2026-54690
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...
CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67178
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2025-58218
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
Malicious code in array-node-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...
MAL-2026-11130 Malicious code in array-node-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
CVE-2026-15267
creationtimestamp| type| source ---|---|--- 2026-07-28 12:11:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpezcbinh2i...
CVE-2026-15012
creationtimestamp| type| source ---|---|--- 2026-07-28 08:43:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrozfdydns2s...
Oracle Enterprise Manager Cloud Control (July 2026 CPU)
The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Ne...
PT-2026-65486
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
CVE-2026-64742
This vulnerability affects multiple Apple platforms, including iOS , iPadOS , tvOS , visionOS , and watchOS . The issue stems from improper network communication, where information was being sent over the network without HTTPS , potentially allowing an application to access sensitive user data . ...
CVE-2026-64742
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...
