bmcweb

OpenBMC webserver This component attempts to be a "do everything" embedded webserver for OpenBMC. Features The webserver implements a few distinct interfaces: DBus event websocket. Allows registering for changes to specific dbus paths, properties, and will send an event from the websocket if thos...

adbHijacker

CVE-2026-0073 — Android ADB TLS Authentication Bypass A proof-of-concept exploit and network scanner for CVE-2026-0073 , a critical zero-click, no-interaction remote code execution vulnerability in Android adbd's ADB-over-TCP authentication path. The vulnerability is a logic bug in...

CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN

CVE-2026-0073 — Android ADBD TLS Authentication Bypass EVPPKEYcmp Type Confusion → Unauthorized ADB Shell 🔥 Overview A critical authentication bypass vulnerability exists in Android's ADB daemon adbd that allows any attacker on the local network to obtain full shell access on a target device...

USN-8933-1 rabbitmq-server vulnerabilities

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04...

Security Bulletin: IBM Documentation Offline may be vulnerable to TLS authentication bypass and authority rebinding due to Node.js (CVE-2026-48618, CVE-2026-48930)

Summary IBM Documentation Offline uses Node.js as its runtime environment. Node.js is affected by two vulnerabilities related to TLS hostname handling. CVE-2026-48618 involves improper handling of Unicode dot separators during TLS certificate verification, which could allow an attacker performing...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

EUVD-2026-84936

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18173 , which allows a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication . The vulnerability is categorized under CWE-295: Improper Certificate Validation . ...

CVE-2026-18173 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: etcd (UTSA-2022-001268)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001268 advisory. In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS...

OESA-2026-3643 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp. Security Fixes: FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname...

OESA-2026-3644 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp. Security Fixes: FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname...

CVE-2026-80904

CVE-2026-80904 is a Linux kernel vulnerability in the net/tls (TLS offload) subsystem. When an asynchronous TLS decryption fails, tls_sw_recvmsg() and tls_sw_read_sock() correctly check async_wait.err and abort the read, but tls_sw_splice_read() performs no such check. As a result, a splice opera...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-106202)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106202 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in...

JLSEC-2026-1347 aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

aria2c accepts a server certificate with incorrect Extended Key Usage EKU. If the attackers compromise a certificate with the associated private key issued for a different purpose, they may be able to reuse it for TLS server authentication...

PT-2026-80784

Name of the Vulnerable Software and Affected Versions redis versions prior to 8.10.1-1.1 Description Multiple security issues affect the redis package, which is an open source, in-memory database that persists data on disk. Recommendations Update to version 8.10.1-1.1...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...