CVE-2020-8289

CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backblaze Summary Name: Remote Code Execution as SYSTEM/root via Backblaze CVE: CVE-2020-8289 Discoverer: Jason Geffner Vendor: Backblaze Product: Backblaze for Windows and Backblaze for macOS Risk: Critical Discovery Date: 2020-03-13...

CVE-2025-26465

CVE-2025-26465 The OpenSSH client contains a logic error between versions 6.8p1 to 9.9p1 inclusive that makes it vulnerable to an active MitM attack if the VerifyHostKeyDNS option is enabled, allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to i...

php: php: Server impersonation via Common Name fallback in TLS verification

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

CVE-2026-113812

A flaw was found in Mozilla::CA. The Certificate Authority CA bundle includes a root certificate linked to compromised intermediate certificates. A remote attacker capable of intercepting or redirecting network traffic could exploit this flaw using the compromised keys to impersonate a Transport...

Linux Distros Unpatched Vulnerability : CVE-2026-107675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersona...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

UBUNTU-CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

PT-2026-108036

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description The libssh-based sftp protocol handler lacks host key verification, which allows network attackers to impersonate SFTP servers. Attackers utilizing man-in-the-middle, DNS, or ARP spoofing can capture...

CVE-2026-107675: Key Exchange without Entity Authentication

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290. This bulletin contains information regarding how to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname...

MikroTik RouterOS Improper Verification of Cryptographic Signature (CVE-2026-67278)

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

CVE-2026-85088

A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...

CVE-2026-91769

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

DEBIAN-CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

PT-2026-99514

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description A DTLS 1.2 client may accept a ChangeCipherSpec message before sending its ClientKeyExchange. Since no master secret is derived at this stage, the client uses read keys derived from a known...