CVE-2026-89135 Failed X509_verify_cert leaves unverified CA in shared CertManager

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

CVE-2026-89135

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

CVE-2026-89135 Failed X509_verify_cert leaves unverified CA in shared CertManager

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

EUVD-2026-87912

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

CVE-2026-89135 Failed X509_verify_cert leaves unverified CA in shared CertManager

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

CVE-2026-89135

The wolfSSL library, versions 5.8.4 through 5.9.2 , is vulnerable to a flaw where a failed X509_verify_cert call permanently installs an unverified attacker Certificate Authority (CA) into the shared CertManager . This allows an attacker to bypass certificate validation across various consumers, ...

CVE-2026-89135

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

EUVD-2026-87908

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...

CVE-2026-94417

The wolfSSL library (all versions from 5.9.2 and earlier ) is vulnerable to a certificate revocation bypass when both OCSP and CRL checking are enabled. The flaw exists in ProcessPeerCerts() , where a soft-fail policy for missing OCSP responders causes the system to skip CRL checks for peer certi...

CVE-2026-100665

A flaw was found in Netty. During certificate validation for Quick UDP Internet Connections QUIC, standard trust managers fail to perform endpoint identification to confirm the server's identity. A remote attacker positioned on the network path can exploit this flaw by presenting a valid...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Heym versions 0.0.90 and earlier contain two server-side request forgery SSRF egress gaps, both remediated in app/services/ssrfguard.py in 0.0.91. First, the LLM image-edit input loader loadimagebytes fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check an...

CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Heym versions 0.0.90 and earlier contain two server-side request forgery SSRF egress gaps, both remediated in app/services/ssrfguard.py in 0.0.91. First, the LLM image-edit input loader loadimagebytes fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check an...

CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Heym versions 0.0.90 and earlier contain two server-side request forgery SSRF egress gaps, both remediated in app/services/ssrfguard.py in 0.0.91. First, the LLM image-edit input loader loadimagebytes fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check an...

CVE-2026-100863

Heym versions 0.0.90 and earlier are vulnerable to Server-Side Request Forgery (SSRF) due to two specific gaps in the app/services/ssrf_guard.py component. First, the LLM image-edit input loader (_load_image_bytes) performed direct httpx.get requests on caller-controlled URLs, bypassing the egres...

CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

Linux Distros Unpatched Vulnerability : CVE-2026-100693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to...

CVE-2026-100833: Improper Input Validation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-88771: Improper Input Validation

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated...

PT-2026-99529

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.9.3 Description A flaw exists in the X.509 certificate validation logic regarding the enforcement of NameConstraints extensions. When an unconstrained CA tier exists between a name-constrained intermediate CA and th...