297 matches found
pared
Pared Pared is a secure, high-performance Linux host security control plane and real-time administrative web console written in Crystal. Built on Kemal and Blueprint server-rendered components with SQLite3, a small vanilla-JS/WebSocket layer, and native libsystemd journal streaming, it unifies...
CVE-2026-29145-Tester
CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...
CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
UBUNTU-CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
DEBIAN-CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
ALPINE-CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
CVE-2026-123867
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
CVE-2026-29145-Tester
CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...
nginx-cve-2026-97629
CVE-2026-97629 — nginx TLS session-ticket forgery client-certificate bypass One line of C. One forged TLS session. Found, proved end to end, and coordinated to a fix by PhiNode Labs. A proof-of-concept exploit, the root-cause analysis, the one-line patch and the reproduction evidence for...
CVE-2026-123867: nodejs node: A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a…
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContexthost, ca: protectedCA but no server certificate...
PT-2026-145389
Name of the Vulnerable Software and Affected Versions Node.js versions prior to 22.23.5 Node.js versions prior to 24.22.3 Node.js versions prior to 26.13.1 Description A per-host mutual-TLS mTLS authorization bypass occurs when a TLS server assigns a different client-certificate CA using...
io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security TLS ClientHello messages to bypass the Server Name Indication SNI routing mechanism. This forces a fallback to a less secure...
Security Bulletin:There are multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
Summary There are multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven networ...
Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information. Vulnerability...
Exploit for CVE-2026-112816
lxd-scanner Local triage for CVE-2026-112816, the 10.0...
Exploit for CVE-2026-112816
CVE-2026-112816 — LXD / MicroCloud client-certificate chain au...
CVE-2026-111814
A flaw was found in Apache Traffic Server. Its default outbound session-sharing policy can reuse an existing Transport Layer Security TLS connection authenticated with one client certificate for a transaction configured to present a different certificate. A remote attacker could exploit this flaw...
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that...