PT-2026-133739

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

Rocky Linux 9 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_90494)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202690494 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS proxy...

RockyLinux 8 : python3.12-urllib3 (RLSA-2026:92474)

The remote RockyLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:92474 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS prox...

RHEL 8 : python3.12-urllib3 (RHSA-2026:92474)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:92474 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2026-112816: Canonical LXD: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted...

PT-2026-133682

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.14 through 4.0.14 Canonical LXD versions 5.0.10 through 5.0.10 Canonical LXD versions 5.21.8 through 5.21.8 Canonical LXD versions 6.9 through 6.9 Canonical MicroCloud affected versions not specified Description...

CVE-2026-112816

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted...

urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...

urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...

Important: Red Hat Security Advisory: python3.12-urllib3 security update

An update for python3.12-urllib3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-106036

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

CVE-2026-106036

The Szafir application is vulnerable to improper certificate validation (CWE-295). The software accepts any client or server certificate without performing necessary certificate or hostname validation, which allows for unauthenticated HTTPS connections . An attacker can leverage this by providing...

EUVD-2026-113121

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

CVE-2026-106036 Improper certificate validation in Szafir

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

blacksandbeacon

Black Sand Beacon A Linux C2 beacon with a native in-memory ELF BOF loader, written in C with no Go or Rust runtime. Designed to plug into the LazyOwn RedTeam framework and inspired by Cobalt Strike's Beacon Object Files. This repository contains: Beacons in beacons/v1/, beacons/v2/, beacons/v3/...

python-urllib3 security update

An update is available for python-urllib3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2026:90494 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-71569

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

CVE-2026-71569 Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

CVE-2026-71569 Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...