Exploit for CVE-2026-19553

abraxaslabs.tech · github.com/abraxas ·&...

Improper Certificate Validation

Overview confluent-kafka is a high-level Producer, Consumer and AdminClient compatible with all Apache KafkaTM broker Affected versions of this package are vulnerable to Improper Certificate Validation in HcVaultKmsClient.init in...

Improper Certificate Validation

Overview @graphql-tools/executor-legacy-ws is an A set of utils for faster development of GraphQL tools Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a hardcoded rejectUnauthorized: false in buildWSLegacyExecutor, which unconditionally disables TLS certificate validation for all wss:// connections and cannot be overridden by callers. An attacker...

AZL-106758 CVE-2026-73636 affecting package httpd 2.4.68-1

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

DEBIAN-CVE-2026-73636

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

UBUNTU-CVE-2026-73636

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

CVE-2026-73636

The Apache HTTP Server 2.4.x on all platforms is vulnerable to an authentication bypass via a capture-replay attack in the mod_auth_digest module. When AuthDigestNonceLifetime is set to 0 , a man-in-the-middle (MITM) attacker can replay captured digest authentication credentials by sending crafte...

EUVD-2026-90876

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

CVE-2026-67105 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

CVE-2026-67105 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

CVE-2026-67105

The HCL BigFix Service Management software is affected by an Insecure Communication vulnerability (CWE-319). An attacker with internal network access could intercept unencrypted HTTP traffic between backend services. This allows for the extraction of sensitive data and the execution of man-in-the...

CVE-2026-73636: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...

CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS-STREAM8:CLSA-2026:1788338106)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1788338106 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1787916225)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787916225 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side...

Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781096989)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781096989 advisory. - Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2025:1742926277)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926277 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a maliciou...

Rocky Linux 8 [CIQ] Security Update: libslirp / libslirp-debuginfo / libslirp-debugsource / etc Multiple Vulnerabilities (crlsa-2020_4694)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204694 advisory. containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters CVE-2020-10749 QEMU: slirp: networking out-of-bounds read...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.4:CLSA-2025:1742722852)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1742722852 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a...