7857 matches found
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
PT-2026-66408
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...
CVE-2026-54690
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...
CVE-2026-67178
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
MAL-2026-11130 Malicious code in array-node-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
CVE-2026-15012
creationtimestamp| type| source ---|---|--- 2026-07-28 08:43:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrozfdydns2s...
Oracle Enterprise Manager Cloud Control (July 2026 CPU)
The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Ne...
CVE-2026-64742
CVE-2026-64742 is tied to Apple platforms where an app could access sensitive user data due to insecure network transmission; the issue is addressed by mandating HTTPS. Apple fixed it in iOS/iPadOS/tvOS/visionOS/watchOS 26.6. The combined sources confirm the vulnerability involved sending informa...
CVE-2018-13012
creationtimestamp| type| source ---|---|--- 2026-07-27 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrnlqtkadf2i...
Linux Distros Unpatched Vulnerability : CVE-2026-46600
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-46600 Note that Nessus relies on the...
CVE-2026-66339
CVE-2026-66339 is a vulnerability in libsoup where, after establishing a CONNECT tunnel via an HTTP proxy, the library incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests through the tunnel. This can allow the destination server to capture proxy credentials, resulting...
CVE-2026-12353
CVE-2026-12353 affects RHCS and describes a memory leak in the Java process caused by unauthenticated repeated requests to the TLS/HTTPS endpoint, potentially crashing the RHCS server via Out of Memory. The available documents specify the vulnerability as a network-accessible issue with a low att...