CVE-2026-80443

HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is vulnerable to an improper certificate validation flaw within the API Tool Runner component. This vulnerability allows an Adversary in the Middle (AiTM) to intercept communications. While the impact is rated as High with potential f...

CVE-2026-63571

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

CVE-2026-63569

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-103602

The bc-csharp library by Legion of the Bouncy Castle Inc. versions before 2.7.0 is vulnerable to improper certificate validation in the PkixNameConstraintValidator component. The root cause is a failure to remove the RFC 1034 root-label trailing dot during comparison between names and constraints...

CVE-2026-103602 Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...

EUVD-2026-91232

Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during PKIX certification path validation fo...

CVE-2026-63576 URI name constraints checked against a mis-parsed host

Improper certificate validation in PkixNameConstraintValidator ExtractHostFromURL in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or...

CVE-2026-63569

The bc-csharp library by Legion of the Bouncy Castle Inc. (versions before 2.7.0 ) is vulnerable to improper input validation in the DHAgreement.CalculateAgreement function during MTI/A0 two-pass Diffie-Hellman key exchanges. An on-path attacker can provide a crafted out-of-range or small-order e...

CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value

Improper input validation in DHAgreement.CalculateAgreement MTI/A0 two-pass Diffie-Hellman in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defeating the key authentication MTI/A0 is...

CVE-2026-15999

The bc-csharp library by Bouncy Castle Inc. is vulnerable to improper validation of integrity check values in its AES-CCM implementation in versions before 2.7.0 . The CcmParameters class accepts arbitrary values for the authentication tag (aes-ICVlen), and CcmBlockCipher only validates this leng...

CVE-2026-15999 AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

Improper validation of integrity check value in the AES-CCM implementation CcmParameters and CcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declar...

WSO2-2021-1261

WSO2-2021-1261: Multiple Cross-Site Scripting in WSO2 ESB Due to improper output encoding, multiple Cross Site Scripting XSS attacks have been identified in WSO2 ESB. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Неинтрузивный сканер уязвимостей на основе версии для CVE-2026-4282 , затрагивающей Keycloak и Red Hat Build of Keycloak RHBK. ⚠️ Отказ от ответственности: Этот инструмент предназначен строго для авторизованных исследований в области безопасности, тестирования на проникновени...

CVE-2025-6713

CVE-2025-6713 craft aggregation pipeline to access data without proper authorisation due to improper handling of $mergeCursors in MongoDB v8.0 v7.0 v6.0 6.0.22 installation not very difficult - just use pip3 to install the requirements: pip install -r requirements usage python3 CVE-2025-6713...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2026-21140

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

CVE-2026-63045

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...