33370 matches found
Key Exchange without Entity Authentication
Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication through contrib/paramikovendor.py in the SSH connection path. An attacker can intercept or impersonate an SSH server and have the client connect without validating the server’s host key by...
CVE-2026-38974
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...
Important: python3.9 security, bug fix, and enhancement update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
JLSEC-2026-702 A heap-buffer-overflow vulnerability exists in wolfSSL's `wolfSSL_d2i_SSL_SESSION()` function
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSLd2iSSLSESSION function. When deserializing session data with SESSIONCERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and...
EUVD-2026-44363
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...
CVE-2026-15637
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...
EUVD-2026-43854
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...
EUVD-2026-44046
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...
EUVD-2026-43801
Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...
EUVD-2026-43966
Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...
CVE-2026-50392
Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...
globaleaks-whistleblowing-software v5.0.98
GlobaLeaks is free and open-source whistleblowing software enabling anyone to easily set up and...
CVE-2026-15058
An improper authorization vulnerability exists in the secure messages deletion endpoint of Devolutions Server versions 2026.2.11 and 2026.1.22 . This flaw allows an authenticated user to delete messages belonging to another user by using a direct object reference to the message identifier. Exploi...
EUVD-2026-44330
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener Symfony\Bridge\Monolog\Command\ServerLogCommand binds to 0.0.0.0:9911 by default and processes each received frame with...
GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CVE-2026-50694
Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...
CVE-2026-49783
Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...
CVE-2026-42982
Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...
