openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library

A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent...

SUSE CVE-2026-101019

Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...

SUSE CVE-2026-105236

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...

Why AI Confidence Is Not Validation

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and...

PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

Authorization Bypass

Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control and file validation when handling client uploads across multiple collections sharing an S3 bucket, which allows an authenticated attacker to overwrite existing objects belonging to another...

com.artipie:artipie (>=v0.27.12, <=v0.30.1), com.datasqrl:sqrl-config (0.6.1) +22 more potentially affected by CVE-2026-102461 via io.vertx:vertx-web-validation (>=4.0.0, <=4.5.34)

io.vertx:vertx-web-validation MAVEN version =4.0.0, =v0.27.12, =3.1.0-rc1, =1.0.1, =0.11.0, =0.11.0, =2.13.0, =2.0.0.rc1, =2.0.0.rc1, =0.21.0, =0.32.0 and more Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

dev.vertique:vertique-rest-openapi-validation (>=0.1.0, <=0.3.0), io.smallrye.reactive:smallrye-mutiny-vertx-web-api-service (>=4.0.1, <=4.0.2) +5 more potentially affected by CVE-2026-102461 via io.vertx:vertx-openapi (>=5.1.5, <=5.1.9)

io.vertx:vertx-openapi MAVEN version =5.1.5, =0.1.0, =4.0.1, =1.1.0-rc1, =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.9 Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

CVE-2023-32198

The rancher software suite, including rancher-agent , harvester , and harvester-fips packages, is affected by a vulnerability where Steve fails to validate remote server certificates by default during TLS connections. This Improper Certificate Validation (CWE-295) flaw allows for man-in-the-middl...

CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2025-23390 Fleet doesn’t validate a server’s certificate when connecting through SSH

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet. In cas...

CVE-2025-23390 Fleet doesn’t validate a server’s certificate when connecting through SSH

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet. In cas...

CVE-2026-19377

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

CVE-2026-19377 Improper certificate validation in Cato Client tunnel handshake

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...

CVE-2026-19377 Improper certificate validation in Cato Client tunnel handshake

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence PoP server and intercept or modify tunnel traffic...