CVE-2026-59786 Active agent heartbeat missing TLS check

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity...

CVE-2026-59786 Active agent heartbeat missing TLS check

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity...

CVE-2026-59786

Zabbix Server and Proxy are vulnerable to a flaw where they accept active agent heartbeat messages without performing the required TLS check for configured PSK or certificate authentication. An attacker with access to the Zabbix trapper port can exploit this to report an arbitrary host as availab...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-15911-Confluent_Kafka

CVE-2026-15911: Verificación de certificados TLS deshabilitada para HashiCorp Vault KMS en confluent-kafka Severidad: Alta, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Afectado: confluent-kafka = 2.8.0, = 2.14.2 Corregido en: 2.15.0 CWE: CWE-295 Validación de certificad...

Dead.Letter-CVE-2026-45185

CVE-2026-45185 — Escáner de vulnerabilidades de Exim «Dead.Letter» Un script de shell para detectar si un sistema Linux es vulnerable a CVE-2026-45185, un use-after-free en el agente de transferencia de correo Exim que puede conducir a la ejecución remota de código. Diseñado para su uso en...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290. This bulletin contains information regarding how to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname...

1Panel-CVE-2025-54424-

CVE-2025-54424 CVE-2025-54424: أداة متكاملة لثغرة تجاوز شهادة العميل لـ 1Panel مما يؤدي إلى RCE مسح + استغلال نظرة عامة على الثغرة 1Panel هي لوحة إدارة تشغيل وصيانة Linux مفتوحة المصدر وحديثة، توفر واجهة رسومية لنشر مواقع الويب وإدارة الخوادم وتشغيل الخدمات. في الإصدارات المتأثرة، تكون سياسة مصاد...

CVE-2026-105295

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105223

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

EUVD-2026-92159

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295

GitAhead versions 2.5.0 through 2.7.1 are vulnerable to an insecure update mechanism that fails to perform integrity or signature verification on downloaded updates. Additionally, the application permanently ignores TLS errors after a single SSL error dialog is presented. A network attacker can e...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

EUVD-2026-92155

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105223

The maclof kubernetes-client (versions 0.17.0 before 0.32.0 ) contains a vulnerability where the parseKubeconfig() and parseKubeconfigFile() functions disable TLS certificate verification if a kubeconfig lacks certificate-authority-data. This occurs even when insecure-skip-tls-verify is not set. ...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...