CVE-2026-107938: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107819: Improper Validation of Certificate with Host Mismatch

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

RockyLinux 10 : python3.12 (RLSA-2026:77020)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77020 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

RockyLinux 10 : python3.14 (RLSA-2026:77018)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77018 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

AlmaLinux 10 : python3.12 (ALSA-2026:77020)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77020 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

Linux Distros Unpatched Vulnerability : CVE-2026-88647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

PT-2026-109271

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

CVE-2026-106581: Improper Verification of Cryptographic Signature

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer...

CVE-2026-103329: Improper Verification of Cryptographic Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

PT-2026-109169

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

PT-2026-109165

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

PT-2026-109167

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

RockyLinux 9 : python3.12 (RLSA-2026:77017)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77017 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

RockyLinux 9 : python3.14 (RLSA-2026:77021)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77021 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

AlmaLinux 9 : python3.14 (ALSA-2026:77021)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77021 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791572599)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791572599 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a differen...

log4shell-hotfix-side-effect

Caso de prueba del efecto secundario del hotfix de Log4Shell Quería saber si se genera alguna ClassNotFoundException o excepción inesperada similar cuando se aplica el hotfix de CVE-2021-44228, también conocido como Log4Shell, según lo recomendado aquí. Resultado: parece que no surge ninguna...

CVE-2026-67693

A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage KU and Extended Key Usage EKU extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could...

CVE-2026-107675

A flaw was found in FFmpeg. The libssh-based SFTP SSH File Transfer Protocol handler fails to verify remote host keys when establishing connections. A remote network attacker capable of intercepting network traffic could exploit this flaw to impersonate legitimate SFTP servers, potentially exposi...