80 matches found
PT-2026-51270
Name of the Vulnerable Software and Affected Versions centraldogma-server-mirror-git versions prior to 0.84.0 Description The Git mirror SSH client fails to verify remote host keys for git+ssh:// connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to...
openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages
A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...
CVE-2026-42312
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The option "general",...
CVE-2026-33569: Cleartext Transmission of Sensitive Information
Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device...
CVE-2026-20115
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by...
CVE-2026-4247 TCP: remotely exploitable DoS vector (mbuf leak)
When a challenge ACK is to be sent tcprespond constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf. If an attacker is either on path with an established TCP connection, or can themselves...
CVE-2026-4247 TCP: remotely exploitable DoS vector (mbuf leak)
When a challenge ACK is to be sent tcprespond constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf. If an attacker is either on path with an established TCP connection, or can themselves...
CVE-2026-20115
Cisco IOS XE Software for Cisco Meraki contains a vulnerability that could allow a remote, unauthenticated attacker to view confidential device information. The issue stems from a device configuration upload performed over an insecure tunnel, enabling an on-path attacker between the affected devi...
Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by...
CVE-2026-20115: Cleartext Transmission of Sensitive Information
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by...
PT-2026-27798
Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software for Cisco Meraki affected versions not specified Description A flaw exists in Cisco IOS XE Software for Cisco Meraki that may allow a remote, unauthenticated attacker to view sensitive device information. The issue stems...
CVE-2025-15557
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication,...
CVE-2025-15557: Improper Certificate Validation
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication,...
CVE-2025-67229
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation...
CVE-2025-14758 Initialization of a Resource with an Insecure Default in YAOOK
Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials...
CVE-2025-14758: Initialization of a Resource with an Insecure Default
Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials...
CVE-2025-11493
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by...
EUVD-2024-34087
Malicious code in bioql PyPI...
CVE-2025-20126: Improper Certificate Validation
A vulnerability in certification validation routines of Cisco ThousandEyes Endpoint Agent for macOS and RoomOS could allow an unauthenticated, remote attacker to intercept or manipulate metrics information. This vulnerability exists because the affected software does not properly validate...
CVE-2024-41681: Inadequate Encryption Strength
A vulnerability has been identified in Location Intelligence family All versions V4.4. The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connectio...