3267 matches found
Erlang/OTP 22.2 < 27.3.4.18 / 28.0 < 28.5.0.7 / 29.0 < 29.1.1 TLS 1.3 Server Authentication Bypass (CVE-2026-89422)
The version of Erlang/OTP installed on the remote host is 22.2 prior to 27.3.4.18, 28.0 prior to 28.5.0.7, or 29.0 prior to 29.1.1. It is, therefore, affected by a vulnerability: - Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 clie...
Linux Distros Unpatched Vulnerability : CVE-2026-100419
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree...
openSUSE 16 Security Update : alloy (openSUSE-SU-2026:21899-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21899-1 advisory. - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs...
CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...
CVE-2026-88907
The software TÜBİTAK ULAKBİM UlakPDF contains an Incorrect Authorization vulnerability that enables an Authentication Bypass . This issue is specifically linked to a SAML ePPN Attribute Validation Bypass . The vulnerability affects versions through 09092026 . The impact includes high levels of co...
CVE-2026-88907 SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026...
RUSTSEC-2026-0312 Excluded iPAddress name constraints with an all-zero mask are not applied
An excludedsubtrees iPAddress name constraint with an all-zero mask 0.0.0.0/0 or ::/0 does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a /0 prefix matches every address of its family, so the exclusion was silentl...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124475)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124475 advisory. When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips...
RLSA-2026:70201 Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint...
podman security update
An update is available for podman. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The podman tool manages pods, container images, and containers. It is part of...
CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...
CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...
CVE-2026-91812
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...
EUVD-2026-85162
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...
RockyLinux 10 : podman (RLSA-2026:70201)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/...
AlmaLinux 10 : podman (ALSA-2026:70201)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/2...
Debian dsa-6397 : pdns-recursor - security update
The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6397 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6397-1 [email protected] https://www.debian.org/securit...
CVE-2026-93601
A flaw was found in rustls-webpki. This component incorrectly processes DNS Domain Name System name constraints for certificates asserting a wildcard name. This could allow a misissued wildcard certificate to be accepted for a domain that should be outside its permitted scope. Consequently, this...
CVE-2026-85288
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...
EUVD-2026-84571
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...