Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the libssh API fallback to a built-in global knownhosts file if the host was not found in the specified one. An attacker can bypass host authenticity checks by leveraging...

ALPINE-CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079

CVE-2025-15079 affects curl/libcurl when using SSH-based transfers (SCP/SFTP) with a libssh backend. The vulnerability arises in known_hosts handling: even if a per-file known_hosts is used, connections could be accepted for hosts not present in that file if they are recognized in the libssh glob...

CVE-2025-15079 libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

EUVD-2026-1390

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in SIccCalcOp::ArgsPushed at IccProfLib/IccMpeCalc.cpp. This...

EUVD-2026-1393

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in CIccTagCurve::CIccTagCurve. This vulnerability affects users of the iccD...

CVE-2026-21680 iccDEV has Null Pointer Dereference in CIccProfile::CheckTagTypes()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have a NULL pointer dereference vulnerability. This vulnerability affects users of the iccDEV libra...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2009-0556link is external Microsoft Office PowerPoint Code Injection Vulnerability CVE-2025-37164link is external HPE OneView Code Injection Vulnerability These...

CVE-1999-0625

The rpc.rquotad service is running...

CURL-CVE-2025-15079 libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

PT-2026-1860

Name of the Vulnerable Software and Affected Versions Perch CMS version 3.2 Description A stored Cross-Site Scripting XSS issue exists in Perch CMS. An attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The...

Linux Distros Unpatched Vulnerability : CVE-2025-15079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present ...

UBUNTU-CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

@zentity/fhevm-contracts (>=0.1.0, <=0.2.0) potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.3.0)

@openzeppelin/confidential-contracts NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @zentity/fhevm-contracts =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory:...

PT-2026-1300

Name of the Vulnerable Software and Affected Versions Silicon Labs Z-Wave Protocol Controller affected versions not specified Description An integer underflow condition exists in the Silicon Labs Z-Wave Protocol Controller, potentially leading to out-of-bounds memory reads. This occurs due to an...

PT-2026-1067

Name of the Vulnerable Software and Affected Versions REDCap version 14.3.13 Description REDCap version 14.3.13 is affected by an issue that allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. Recommendations At the moment, there is no information...

CVE-2025-13820

The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user when knowing their email address when such user does not have an account on disqus.com yet...