CVE-2026-112339 Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wmfluentsslctx that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured cafile. Attackers who redirect the...

CVE-2026-112339

Wazuh versions 3.9.0 before 4.14.9 are vulnerable to a missing TLS hostname verification in the fluent-forward module's wm_fluent_ssl_ctx() function. This flaw allows network attackers to impersonate the Fluentd collector by presenting any certificate chain linked to the configured ca_file. By us...

EUVD-2026-118282

Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wmfluentsslctx that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured cafile. Attackers who redirect the...

MAL-2026-6327 Malicious code in security-alerts-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f881805b709189d00bc52dc57c407bfecdae44fb343f92634a301c31525f6b0 Despite advertising itself as a breach-monitoring SDK, this package executes a remote-access trojan and credential harvester against any installer th...

CVE-2025-10542: Use of Default Credentials

iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and dat...