CVE-2026-109461: Origin Validation Error

Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...

PT-2026-115975

Name of the Vulnerable Software and Affected Versions Microsoft Authentication Library MSAL for Node.js affected versions not specified Description An origin validation error allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no...

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach th...

Linux Distros Unpatched Vulnerability : CVE-2026-105280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE...

Linux Distros Unpatched Vulnerability : CVE-2026-111555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe...

Zoom Workplace 7.0.x < 7.1.9 / 7.2.0 Improper Certificate Validation (ZSB-26021)

The version of Zoom Workplace installed on the remote host is 7.0.x prior to 7.1.9 / 7.2.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-26021 advisory. - Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an...

Linux Distros Unpatched Vulnerability : CVE-2026-62322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the...

Zoom Workplace VDI Client 7.0.11 < 7.0.13 Improper Certificate Validation (ZSB-26021)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.13. It is, therefore, affected by a vulnerability as referenced in the ZSB-26021 advisory. - Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an...

Microsoft Power Apps < 3.26085.3.0 Remote Code Execution (October 2026)

The Windows 'Microsoft Power Apps' app installed on the remote host is prior to version 3.26085.3.0. It is, therefore, affected by a remote code execution vulnerability: - Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. CVE-2026-70213...

Zoom Rooms 7.0.x < 7.1.7 Improper Certificate Validation (ZSB-26021)

The version of Zoom Rooms installed on the remote host is 7.0.x prior to 7.1.7. It is, therefore, affected by a vulnerability as referenced in the ZSB-26021 advisory. - Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information...

Linux Distros Unpatched Vulnerability : CVE-2026-96222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network. CVE-2026-96222...

Linux Distros Unpatched Vulnerability : CVE-2026-103503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued...

CVE-2026-16754

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...

CVE-2026-16754

The Lenovo Smart Camera C33 , distributed exclusively in the Chinese market, is susceptible to an improper certificate validation vulnerability (CWE-295). This flaw could allow an adjacent user to intercept or manipulate network communications. No specific root cause components, exploit details, ...

CVE-2026-16754

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...

CVE-2026-96222

Improper certificate validation in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-111323

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

CVE-2026-110916

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Improper Certificate Validation

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped a...

Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored ...