CVE-2026-67598

CVE-2026-67598 Emlog Pro — отключённая проверка TLS-сертификатов в ИИ-ассистенте MITM из соседней сети → кража API-ключа LLM-провайдера & внедрение ИИ-ответов Сводка · Схема атаки · Затронутый код · Подтверждение · Устранение · Хронология · Ссылки 📋 Краткий обзор | ---|--- CVE ID| CVE-2026-67598...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

CVE-2025-65753

CVE-2025-65753 Доказательство концепции для CVE-2025-65753: удалённое выполнение кода на точке доступа Gryphon Guardian с версией прошивки 01.06.0006.22 через некорректную проверку TLS-сертификата. Описание Точка доступа WiFi Gryphon Guardian с версией прошивки 01.06.0006.22 не выполняет должную...

MAL-2026-17663 Malicious code in mfasolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1984:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1984:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1972:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1972:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790971363)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790971363 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790971363)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790971363 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

Security Bulletin: IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by a vulnerability (CVE-2026-14435)

Summary IBM Turbonomic Kubeturbo is an agent that integrates IBM Turbonomic with Kubernetes environments, including Red Hat OpenShift. The agent collects performance and configuration data and when deployed with sufficient privileges, enables IBM Turbonomic to make configuration changes that...

CVE-2026-85088

A flaw was found in Apache Thrift. During Transport Layer Security TLS certificate validation, the client libraries improperly evaluate the certificate's Common Name CN when subject alternative name SAN entries do not match the target host. A network-positioned attacker possessing a trusted...

CVE-2026-80443 Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80443 Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-15911

A flaw was found in confluent-kafka. The HashiCorp Vault Key Management Service KMS integration fails to properly validate Transport Layer Security TLS certificates by default. A remote attacker able to intercept network traffic could exploit this flaw to intercept and decrypt sensitive data or...

Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_73428)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673428 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

EUVD-2026-91026

The Joyland AI app accepts any TLS certificates from any server without validation...

CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-15911

The Confluent Kafka Python client contains a vulnerability in its HashiCorp Vault KMS integration due to a failure to properly validate Transport Layer Security (TLS) certificates by default. A remote attacker capable of intercepting network traffic could exploit this flaw to intercept and decryp...

CVE-2026-15911 Confluent Kafka Python Improper TLS Certificate Validation

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...