pared

Pared Pared هي مستوى تحكم control plane خفيف الوزن وآمن ولوحة تحكم إدارية عبر الويب في الوقت الفعلي، مكتوبة بلغة Crystal لتأمين أنظمة Linux المضيفة. توفر إدارة مركزية لواجهات firewalld عبر DBus/CLI واتصالات NetworkManager، وتتميز بتوثيق متبادل عبر TLS mTLS، ومصادقة PAM/SSSD، وبث مباشر في الوقت...

CVE-2026-29145-Tester

بيئة اختبار CVE-2026-29145 📌 نظرة عامة يحتوي هذا المستودع على بيئة إثبات المفهوم PoC مصممة لاختبار CVE-2026-29145. الثغرة هي تجاوز للمصادقة في تنفيذ Tomcat من Apache لـ Mutual TLS CLIENTCERT. عندما يتم تكوين OCSP بروتوكول حالة الشهادة عبر الإنترنت مع تعطيل الفشل الناعم، قد يفشل Tomcat في التعامل ...

CVE-2026-29145-Tester

بيئة اختبار CVE-2026-29145 📌 نظرة عامة يحتوي هذا المستودع على بيئة إثبات مفهوم PoC مصممة لاختبار CVE-2026-29145. الثغرة هي تجاوز للمصادقة في تنفيذ Tomcat من Apache لـ TLS المتبادل CLIENTCERT. عندما يتم تكوين OCSP بروتوكول حالة الشهادة عبر الإنترنت مع تعطيل الفشل الناعم، قد يفشل Tomcat في التعامل ...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

DEBIAN-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

UBUNTU-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

EUVD-2026-63095

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty (asynchronous, event-driven network framework) is affected by an SNI routing bypass in io.netty.handler.ssl.SslClientHelloHandler#decode . The method checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records triggers an ...

CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-50578

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

CVE-2026-50578

Versions of ePA 3.x Integration before 1.3.0 disable TLS certificate verification (self.session.verify=False) in app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py, allowing a network attacker to present arbitrary certificates, terminate TLS, and intercept or observe mutual-TLS smartcard exch...

CVE-2026-50578 ePA 3.x Integration: TLS Certificate Verification Universally Disabled

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

CVE-2026-50578 ePA 3.x Integration: TLS Certificate Verification Universally Disabled

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

EUVD-2026-61056

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

PT-2026-66778

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

ALPINE-CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...