149338 matches found
CVE-2026-80443
Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-94635
A vulnerability exists in the Apache Thrift Lua bindings (versions before 0.25.0 ) caused by the improper handling of length parameter inconsistencies . Specifically, the TBinaryProtocol:readMessageBegin function may bypass checkStringSize on the pre-versioned name, allowing a remote attacker to ...
CVE-2026-94635
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
EUVD-2026-91326
Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-80443
HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is vulnerable to an improper certificate validation flaw within the API Tool Runner component. This vulnerability allows an Adversary in the Middle (AiTM) to intercept communications. While the impact is rated as High with potential f...
CVE-2026-63571
Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...
CVE-2026-63569
Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...
CVE-2026-103602
The bc-csharp library by Legion of the Bouncy Castle Inc. versions before 2.7.0 is vulnerable to improper certificate validation in the PkixNameConstraintValidator component. The root cause is a failure to remove the RFC 1034 root-label trailing dot during comparison between names and constraints...
CVE-2026-103602 Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...
EUVD-2026-91232
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...
CVE-2026-63569
The bc-csharp library by Legion of the Bouncy Castle Inc. (versions before 2.7.0 ) is vulnerable to improper input validation in the DHAgreement.CalculateAgreement function during MTI/A0 two-pass Diffie-Hellman key exchanges. An on-path attacker can provide a crafted out-of-range or small-order e...
CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...
CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...
CVE-2026-15999
The bc-csharp library by Bouncy Castle Inc. is vulnerable to improper validation of integrity check values in its AES-CCM implementation in versions before 2.7.0 . The CcmParameters class accepts arbitrary values for the authentication tag (aes-ICVlen), and CcmBlockCipher only validates this leng...
CVE-2026-15999 AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication
Improper validation of integrity check value in the AES-CCM implementation CcmParameters and CcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declar...
WSO2-2021-1261
WSO2-2021-1261: WSO2 ESB의 여러 크로스 사이트 스크립팅 잘못된 출력 인코딩으로 인해 WSO2 ESB에서 여러 크로스 사이트 스크립팅XSS 공격이 확인되었습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. CVE가 없는 이유는? 저나 공급업체 모두 이 취약점에 대해 CVE를 요청하지 않았습니다. 요구 사항: 이 취약점은 다음을 요구합니다: 일부 XSS는 유효한 사용자 자격 증명이 필요합니다. 개념 증명: 자세한 내용과 악용 과정은 이 PDF에서 확인할 수...
CVE-2026-4282-Scanner
CVE-2026-4282-Scanner CVE-2026-4282 に対応する、Keycloak および Red Hat Build of Keycloak RHBK に影響を与える脆弱性を対象とした、非侵入型のバージョンベース脆弱性スキャナーです。 ⚠️ 免責事項: このツールは、許可されたセキュリティ研究、ペネトレーションテスト、および防御的な脆弱性管理のみを目的としています。自身が所有するシステム、またはテストに対する明示的な書面による許可を得たシステムに対してのみ実行してください。このスキャナーはエクスプロイトを一切行いません —...
CVE-2025-6713
CVE-2025-6713 aggregation pipeline을 조작하여 적절한 권한 없이 데이터에 접근합니다. 이는 MongoDB v8.0 v7.0 v6.0 6.0.22에서 $mergeCursors의 부적절한 처리로 인해 발생합니다. 설치 어렵지 않습니다. pip3를 사용해 requirements를 설치하기만 하면 됩니다: pip install -r requirements 사용법 python3 CVE-2025-6713 실험 직접 테스트하려면 다음을 수행하세요. 1. 4, 5, 6, 7, 9, 10행: mconnect =...
CVE-2026-25049
🚨 CVE-2026-25049 – n8n 未認証設定情報の開示 📌 概要 CVE ID: CVE-2026-25049 影響を受けるソフトウェア: n8n 深刻度: Critical カテゴリ: 不適切なアクセス制御 / 情報開示 この脆弱性により、特定の n8n デプロイ環境では、REST API エンドポイントを介して認証なしで内部設定データにアクセス できる可能性があります。 🧭 目次 概要 技術詳細 影響 影響を受けるバージョン 検証 緩和策 セキュリティ上の注意 免責事項 🔍 技術詳細 脆弱な設定では、以下のエンドポイントが認証なしでアクセス可能です: GET...