1812 matches found
CVE-2026-73253
Mongoose (embedded web server and network library) prior to version 7.22 is vulnerable to a TLS hostname verification bypass . The root cause is in mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() (in src/tls_builtin.c), which call mg_match() — a function whose wildcard matching can cross DNS...
CVE-2026-55558
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
CVE-2026-55558 aiosmtplib: STARTTLS response injection
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...
PT-2026-79077
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...
CVE-2026-43798: Stack-based Buffer Overflow
A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1...
.NET: .NET Core: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-43667
A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service...
EUVD-2026-60110
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
CVE-2026-53970
ZeroBrew 0.3.1 and earlier is affected by a missing integrity verification vulnerability in the Ruby compatibility shim (shim.rb). An attacker could substitute malicious content at formula resources or URL-based patch URLs without checksum validation, allowing remote code execution when downloads...
CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
EUVD-2026-58684
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
PT-2026-72043
Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...
CVE-2026-72579
An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...
CVE-2026-15570 Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue...
PT-2026-69135
Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5rc1 Description The API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed document content, upload or delete document...
CVE-2026-62830
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
CVE-2026-65400
An authentication bypass in the screensharingd daemon on macOS allows a network attacker to authenticate to Screen Sharing without valid credentials. The vulnerability stems from a stale success status returned by the SRP (Secure Remote Password) frame-length validator, meaning the connection is ...
CVE-2026-48088: Missing Authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...
About the security content of macOS Sonoma 14.8.9
This document describes the security content of macOS Sonoma 14.8.9. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the...
About the security content of macOS Tahoe 26.6.1
About the security content of macOS Tahoe 26.6.1 This document describes the security content of macOS Tahoe 26.6.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...