210313 matches found
CVE-2026-71889
A flaw was found in Bouncy Castle. The certificate path reviewer PKIXCertPathReviewer fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing...
CVE-2026-91881
The Dell Terraform Provider for Redfish contains a Critical Improper Certificate Validation vulnerability (CWE-295) in its HTTP transport component (versions prior to 1.6.2 ). The root cause is that TLS certificate verification is unconditionally disabled in the base HTTP transport. This allows a...
CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...
CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...
EUVD-2026-101152
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...
CVE-2026-85047
An improper input validation flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513790581...
Security Bulletin: IBM Storage Protect Server is affected by an improper domain name validation vulnerability (CVE-2026-42579).
Summary IBM Storage Protect Server uses the netty-codec-dns library in certain components. A vulnerability in netty could allow improper handling of domain names that do not comply with RFC 1035 constraints. An attacker can exploit this through malicious DNS responses or specially crafted...
CVE-2026-101019 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
[SECURITY] [DSA 6559-1] buildstream security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6559-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...
K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019
Security Advisory Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return...
Security update for containerd
This update for containerd fixes the following issues: CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation bsc1268430. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...
USN-8929-1: Bind vulnerabilities
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the wolfSSL backend during the TLS handshake process. An attacker can cause improper authorization of an invalid key by presenting a specially crafted certificate with a manipulated validity length...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the knownhost callback process. An attacker can cause the application to trust an unverified server by intercepting SSH network traffic and exploiting the mishandling of host key verification. This is...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the redirect process. An attacker can intercept sensitive information by redirecting requests to an untrusted server, causing the connection to proceed without validating the...
Improper Validation of Specified Quantity in Input
Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the cookie jar process. An attacker can cause the client to ignore all remaining valid cookies in the cookie file by inducing it to store an oversized cookie, which leads to abortin...
curl: libcurl: Improper certificate validation due to cached TLS settings reuse
A flaw was found in libcurl. When handling secure connections TLS and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise...
knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
USN-8926-1 python-urllib3 vulnerabilities
Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain certificate validations. An attacker could possibly use this issue to observe or modify forwarded traffic. This issue only affected Ubuntu 26.04 LTS. CVE-2026-97687 Martin Desrumaux discovered that...