Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Note: This advisory is applicable to Amazon Linux 2...

openSUSE 16 Security Update : open-iscsi (openSUSE-SU-2026:21580-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21580-1 advisory. Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attacke...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Issue Correction: Run dnf update isns-utils...

Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

Security update for open-iscsi (important)

openSUSE security update: security update for open-iscsi ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21580-1 Rating: important References: bsc1268352 bsc1268353 Cross-References: CVE-2026-44943 CVE-2026-44944 CVSS scores: CVE-2026-44943 SUSE : 8...

EUVD-2026-58756

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-49457 QUIC has Broken TLS verification

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

SUSE-SU-2026:23157-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

EUVD-2026-58116

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

OESA-2026-3340 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3339 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3338 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3337 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

CVE-2026-0298

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle MitM attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges SYSTEM privileges on Windows, and root privileges on...

EUVD-2026-57425

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...