EUVD-2026-110605

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

CVE-2026-117471

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

CVE-2026-117471 User-controlled Duo host permits authenticated SSRF in Psono Server

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

CLEANSTART-2026-EJ80416 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

Oracle Linux 9 : python-urllib3 (ELSA-2026-90494)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-90494 advisory. - CVE-2026-97687 python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282326 Tenable has extracted...

PT-2026-125873

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

Fortinet FortiOS: CVE-2026-106174: GUI Denial of Service

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

Oracle GoldenGate 21.x < 21.24.0.0.0 (October 2026 CPU)

The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 21.3-21.23. Easily exploitable...

Node.js HTTPS Bypass

The vulnerability related to the implementation of the HTTPS protocol in the Node.js software platform stems from a lack of validation of host certificate data. Exploitation of this vulnerability could enable a remote attacker to bypass existing security mechanisms...

MiracleLinux 9 : python-urllib3-1.26.5-8.el9_8.2 (AXSA:2026-2170:05)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2170:05 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS...

Fortinet FortiOS race condition vulnerability

Versions 8.0.0 and 7.6.4 through 7.6.6 of Fortinet FortiOS contain a race condition vulnerability. This vulnerability stems from improper locking mechanisms; unauthenticated attackers can gain network access and send specially crafted HTTP requests, resulting in denial of service on the HTTPS...

Oracle GoldenGate 19.x < 19.33.0.0.261020 (October 2026 CPU)

The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.32.0.0. Easily...

Important: Red Hat Security Advisory: python-urllib3 security update

An update for python-urllib3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...

Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

CVE-2026-72755

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails...

CVE-2026-72755 Routinator stores TA certificate in cache without validation

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails...

CVE-2026-72755

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails...

EUVD-2026-110028

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails...

ip-https-tools

ip-https-tools A collection of tools for the IP over HTTPS IP-HTTPS Tunneling Protocol used by Microsoft DirectAccess to send Teredo related IPv6 packets over an IPv4-based HTTPS session. MS-IPHTTPS protocol pecification DirectAccess Technical Overview DirectAccess Requirements DirectAccess...