OESA-2026-4627 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...

curl: libcurl: Improper certificate validation due to cached TLS settings reuse

A flaw was found in libcurl. When handling secure connections TLS and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.5:CLSA-2026:1786092535)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1786092535 advisory. - libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited...

EUVD-2026-89000

urllib3: HTTPS proxy TLS configuration may be ignored or overridden...

AZL-105663 CVE-2026-97687 affecting package python-urllib3 2.0.7-6

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

PT-2026-109069

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

SUSE CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-92756 Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

PT-2026-93828

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

Cross-site Scripting (XSS)

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized input in the Mail Settings configuration fields. An attacker can execute arbitrary JavaScript in the browser context of an...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context during the LDAPS transfers. An attacker can impact the security of concurrent transfers by manipulating TLS settings in one thread, which may inadvertently alter the global...

EUVD-2022-26872

Malicious code in bioql PyPI...

CVE-2025-55118 BMC Control-M/Agent memory corruption in SSL/TLS communication

Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "useopenssl=n"; Control-M/Agent 9.0.21 and 9.0.22: Agent router...

Alibaba Cloud Linux 3 : 0142: curl (ALINUX3-SA-2022:0142)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0142 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-22576: An improper authentication...

Rancher agents can be hijacked by taking over the Rancher Server URL

Impact A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle MITM attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability...

Microsoft Security Update Validation Report October 2022

Microsoft’s October 2022 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English-only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwar...

USN-5344-1: DBD::mysql vulnerabilities

It was discovered that the DBD::mysql module, when configured with server-side prepared statement support, was susceptible to operations that would result in improper memory access. An attacker could possibly use this issue to cause DBD::mysql to crash, resulting in a denial of service...