tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

CVE-2026-27659

Mattermost CSRF in UpdateAccessControlPolicyActiveStatus: versions 11.2.x ≤ 11.2.2, 10.11.x ≤ 10.11.10, 11.4.x ≤ 11.4.0, 11.3.x ≤ 11.3.1 fail to validate CSRF tokens on /api/v4/access_control_policies/{policy_id}/activate, enabling an attacker to trick an admin into changing an access control pol...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to properly validate CSRF tokens in the /api/v4/accesscontrolpolicies/policyid/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a craft...

CVE-2026-33992

creationtimestamp| type| source ---|---|--- 2026-03-25 13:09:33+00:00| published-proof-of-concept| https://github.com/pyload/pyload/security/advisories/GHSA-m74m-f7cr-432x 2026-03-28 01:18:50+00:00| seen| Telegram/DQ8Phmkx05Q1rHpnB8sJ1vhC9dSxcFzzTf0RtJAOAn3w7JQ 2026-03-28 02:13:28+00:00| seen|...

CVE-2026-28859

creationtimestamp| type| source ---|---|--- 2026-03-25 07:28:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288631079391237 2026-03-27 04:46:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116299318674903445...

CVE-2026-28858

creationtimestamp| type| source ---|---|--- 2026-03-25 06:20:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116288365225347899 2026-03-29 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/ 2026-04-06 18:00:04+00:00| seen| https://t.me/GithubRedTeam/79...

CVE-2026-4696

creationtimestamp| type| source ---|---|--- 2026-03-25 04:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7cz6h4i22 2026-03-26 11:43:17+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhxjlxpqna2k 2026-03-29 17:00:00+00:00| seen|...

CVE-2026-4721

creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260325 2026-03-25 04:01:28+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhu7d6hbhv2w 2026-03-29 17:00:00+00:00| seen|...

SUSE CVE-2026-28682

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes fileid values that are not scoped to the requesting...

SUSE CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the fcloopt2hxmtlsrsp function not checking the status of the remoteport port. This could lead to...

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing th...

CVE-2026-28755

A flaw was found in NGINX, specifically within its ngxstreamsslmodule. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol OCSP for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security TLS...

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

Summary The /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable dela...

Malicious code in product-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b87ef85e41f2a3ee4d9e8e898f2131e8ea1b5d03c9e44368af02a6c45af73a7 The package product-status was found to contain malicious code...

MAL-2026-2385 Malicious code in product-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b87ef85e41f2a3ee4d9e8e898f2131e8ea1b5d03c9e44368af02a6c45af73a7 The package product-status was found to contain malicious code...

EUVD-2026-14887

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...

CVE-2026-1561

creationtimestamp| type| source ---|---|--- 2026-03-24 15:30:04+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3mhsvdoje7e2m 2026-03-26 00:14:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwd4t5c3w2i...

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngxstreamsslmodule module due to the improper handling of revoked certificates when configured with the sslverifyclient on and sslocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the...