Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2023_4952)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234952 advisory. Mozilla: Memory corruption in IPC CanvasTranslator CVE-2023-4573 Mozilla: Memory corruption in IPC ColorPickerShownCallback CVE-2023-4574 Mozilla: Memory...

Rocky Linux 8 [CIQ] Security Update: mutt / mutt-debuginfo / mutt-debugsource Multiple Vulnerabilities (crlsa-2021_4181)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214181 advisory. mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection CVE-2020-28896 mutt: Memory...

PT-2026-103900

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782146244)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782146244 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785564870)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785564870 advisory. - A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same...

AlmaLinux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1781513275)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781513275 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1781513275)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781513275 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

CVE-2026-67406

A flaw was found in rabbitmq-server. When the Shovel plugin worker process crashes due to network or connection failures, it fails to sanitize its internal state before logging error reports. As a result, sensitive connection details and unencrypted credentials, including plaintext passwords, are...

cve-2020-13777

Zeek テストスクリプト CVE-2020-13777 このスクリプトは、サーバーが CVE-2020-13777 に対して脆弱である可能性があるかどうかを確認するための簡単なテストを実行します。 CVE-2020-13777 は GnuTLS に暗号化されていないセッションチケットを作成させます。これは、gnutls が keyname をゼロに設定するかどうかを確認することで検出できるようです。このために、セッションチケットの最初の 16 バイトを使用します。このスクリプトは以下をチェックします: サーバーが不審なセッションチケットを送信する...

CVE-2024-27316

CVE-2024-27316 I decided to call this vulnerability specifically "CVE-2024-27316" since I have tested it against this vulnerability. The underlying flaw effects other CVEs so I thought I'd mention those with the hope that others could test and modify this PoC : This PoC currently only works again...

CLEANSTART-2026-OJ90218 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CVE-2026-82933

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82933

The mH-DEVELOPER smart home module is vulnerable to cleartext transmission of sensitive information because it sends web interface and API traffic over unencrypted HTTP . This allows an attacker on the same network to intercept passwords , authentication tokens , and device commands , potentially...

EUVD-2026-88232

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82933: Undefined Security Weakness

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

EUVD-2026-87470

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...

CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-RR86814 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

EUVD-2026-86481

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...