EUVD-2026-91074

Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25...

CVE-2026-64893

Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25...

CVE-2026-64893

The Johnson Controls EasyIO Neo series (EC and CW controllers) is vulnerable to a Cleartext Transmission of Sensitive Information vulnerability (CWE-319). This flaw allows an attacker to intercept and read sensitive data, such as credentials and session data , transmitted over the network via a M...

EUVD-2026-86413

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code...

CVE-2026-93291

The Eufy Omni C20 is affected by a vulnerability involving improper certificate validation . This flaw could enable an attacker to conduct a man-in-the-middle (MitM) attack, potentially leading to the execution of arbitrary code . No specific software versions, internal components, or remediation...

CVE-2026-93291 Improper certificate validation in Eufy Omni C20

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code...

Astra Linux – Vulnerability in curl

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. As a result, it does not detect impostor attacks or man-in-the-middle attacks...

CVE-2026-90647: Improper Certificate Validation

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

CVE-2026-85221: Improper Certificate Validation

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2025-29419: Channel Accessible by Non-Endpoint

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the AmqpAppender. An attacker can intercept or modify sensitive log data by performing a man-in-the-middle attack on the TLS connection, as hostname verification is disabled by default. Remediation...

CVE-2026-73542: Improper Following of a Certificate's Chain of Trust

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information...

CVE-2026-11751: Undefined Security Weakness

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...

CVE-2026-55402

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

Security update for gleam (moderate)

openSUSE security update: security update for gleam ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21557-1 Rating: moderate References: bsc1272992 Cross-References: CVE-2026-59247 Affected Products: openSUSE Leap 16.0...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...