EUVD-2026-52885

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...

CVE-2025-15628

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2025-9291

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

CVE-2025-15628 Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

CVE-2025-15628

The CVE affects TP-Link Omada devices using embedded certificates shared across deployments. The root cause is hardcoded/embedded certificates enabling impersonation of trusted controllers or devices, allowing interception of communications. The connected documents confirm the same description an...

EUVD-2025-210608

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2025-15544 Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

EUVD-2025-210607

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

CVE-2025-9291 Improper Certificate Validation in TP-Link Omada Cloud Communications

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

CVE-2025-9291 Improper Certificate Validation in TP-Link Omada Cloud Communications

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

CVE-2025-9291

The CVE-2025-9291 entry documents a certificate validation weakness in Omada devices communicating with cloud controllers. Specifically, certificate identity verification does not adequately confirm that a presented certificate matches the expected cloud controller hostname, potentially allowing ...

PT-2026-67460

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related...

PT-2026-67451

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validati...

PT-2026-67457

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

openssh security update

An update is available for openssh. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSH is an SSH protocol implementation supported by a number of Linux, UNI...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-8497

CVE-2026-8497 describes an issue in Devolutions Password Manager (versions up to 2026.2.1.0) where Devolutions Server connection handling performs improper certificate validation on Android, iOS, and macOS. This allows an adjacent-network attacker to intercept and modify sensitive information thr...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...