rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation installrustbuster echo "Installing latest version o...

CVE-2026-117666

A flaw was found in sslverifyfun. The library improperly validates Transport Layer Security TLS certificates containing partial wildcards, allowing wildcard patterns to match across domain label boundaries and IP addresses. A man-in-the-middle attacker can exploit this vulnerability by presenting...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation in the AI Assistant Network-adjacent MITM → LLM-provider API-key theft & AI-response injection Summary · Attack Flow · Affected Code · Proof · Remediation · Timeline · References 📋 At a glance | ---|--- CVE ID| CVE-2026-67598 Product|...

CVE-2025-65753

CVE-2025-65753 Proof of concept for CVE-2025-65753: Remote code execution on the Gryphon Guardian access point, firmware version 01.06.0006.22, through an improper TLS certificate validation. Description The Gryphon Guardian WiFi access point, with firmware version 01.06.0006.22, does not properl...

EUVD-2026-112489

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682

The KaringX ClashMi application (versions through 1.0.32.1801 ) is vulnerable to a Man-in-the-Middle (MITM) attack because the HttpUtils helper disables TLS certificate validation by default. This flaw allows an attacker controlling a proxy node to intercept HTTPS traffic using any certificate. B...

CVE-2026-118682 ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682 ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682 ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

Undici Vulnerable To TLS Certificate Validation Bypass Via Dropped Tls Options In Agent

Impact undici's "Agent" passes its constructor options through a JSON-based deep clone "JSON.parseJSON.stringify..." before forwarding them to each per-origin "Pool". JSON cannot represent functions, so a caller-supplied "tls" option containing a "checkServerIdentity" callback is silently dropped...

KaringX clashmi encryption issue vulnerability

Versions KaringX clashmi 1.0.32.1801 and earlier contain an encryption vulnerability. This vulnerability stems from the default disabling of TLS certificate validation within the HttpUtils helper program. Attackers can exploit this by providing any certificate to intercept HTTPS traffic. They can...

PT-2026-129191

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682: KaringX clashmi: KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing…

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

Impact undici's Agent passes its constructor options through a JSON-based deep clone JSON.parseJSON.stringify... before forwarding them to each per-origin Pool. JSON cannot represent functions, so a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it...

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent vulnerability discovered by ? in WordPress npm undici versions = 4.0.0, 6.29.1...

CVE-2026-41022

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...

CVE-2026-41022

Eaton easySoft software is vulnerable due to improper validation of TLS certificates presented by easyE4 devices. A network-adjacent attacker can exploit this flaw to conduct a man-in-the-middle (MITM) attack , allowing them to intercept or modify communications between easySoft and the easyE4 de...

EUVD-2026-110757

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4...