7857 matches found
kumactl connects to control plane without verifying TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...
CVE-2026-55576
creationtimestamp| type| source ---|---|--- 2026-07-16 00:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwwfqvfb2l...
CVE-2026-52842
creationtimestamp| type| source ---|---|--- 2026-07-15 16:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp62iew3x2w 2026-07-15 19:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgm3qmkx2s...
CVE-2026-51105
creationtimestamp| type| source ---|---|--- 2026-07-14 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e 2026-07-22 05:03:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24...
Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...
PT-2026-58855
Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...
PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...
Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
Malicious code in tinyparrot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...
FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline
Fetch and execute an x86 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...
FTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...
FTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)
Fetch and execute an x64 payload from an FTP server. Tunnel communication over HTTPS Windows x64 winhttp Module Options...
HTTPS Fetch, Linux dup2 Command Shell, Reverse TCP Stager
Fetch and execute an RISC-V 32-bit payload from an HTTPS server. dup2 socket in s1, then execve. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...
EUVD-2026-42942
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIBMBEDTLSSUPPORT or CPPHTTPLIBWOLFSSLSUPPORT and a...
CVE-2026-15000
creationtimestamp| type| source ---|---|--- 2026-07-09 22:33:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaouyr2752e...
PYSEC-2026-2413 OpenStack Keystone and other components vulnerable to Improper Certificate Validation
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...
CVE-2026-47828
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...
CVE-2026-8651
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer HTTPS module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...
CVE-2026-8651
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer HTTPS module. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...