PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

Authorization Bypass

Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control and file validation when handling client uploads across multiple collections sharing an S3 bucket, which allows an authenticated attacker to overwrite existing objects belonging to another...

CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2023-32198

The rancher software suite, including rancher-agent , harvester , and harvester-fips packages, is affected by a vulnerability where Steve fails to validate remote server certificates by default during TLS connections. This Improper Certificate Validation (CWE-295) flaw allows for man-in-the-middl...

CVE-2025-23390 Fleet doesn’t validate a server’s certificate when connecting through SSH

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet. In cas...

CVE-2026-19377

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

CVE-2026-19377 Improper certificate validation in Cato Client tunnel handshake

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

EUVD-2026-101881

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

CVE-2026-19377

The Cato Client is vulnerable to a security flaw due to improper certificate validation during the tunnel handshake. This allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server , enabling them to intercept or modify tunnel traffic. No specific exploit information...

CVE-2026-110934

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...

EUVD-2026-101869

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...

CVE-2026-110934

The Samsung Open Source Vyond project contains an improper validation of array index vulnerability (CWE-129). This flaw allows for Input Data Manipulation . The vulnerability affects versions of Vyond prior to commit be6e297b0c4836e20d73b2f8a40a561ea496ebaa . According to the provided metrics, th...

CLEANSTART-2026-YH75013 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

CVE-2026-85525 affects multiple packages. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node. See references for individual vulnerability details...

EUVD-2026-101753

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

EUVD-2026-101733

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...

EUVD-2026-101725

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member...

CVE-2026-110934: Improper Validation of Array Index

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...