CVE-2026-14999: Improper Verification of Cryptographic Signature

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures...

CVE-2026-13257: Insufficient Verification of Data Authenticity

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity...

PT-2026-108036

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description The libssh-based sftp protocol handler lacks host key verification, which allows network attackers to impersonate SFTP servers. Attackers utilizing man-in-the-middle, DNS, or ARP spoofing can capture...

CVE-2026-107576: Inefficient Algorithmic Complexity

Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header...

PT-2026-108179

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A signature verification bypass exists in the patch installer. This flaw allows an attacker with local access to execute arbitrary code with root privileges, which is the highest level of...

PT-2026-108208

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 12.7.0 Description Built-in HTTPS transports in this Fastify plugin override the secure default by setting rejectUnauthorized to false. This prevents the proxy from verifying the TLS certificate of the...

RHEL 9 : python3.14 (RHSA-2026:77021)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77021 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

MiracleLinux 8 : python3.12-3.12.15-2.el8_10 (AXSA:2026-1997:24)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1997:24 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of...

RHEL 9 : python3.12 (RHSA-2026:77017)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77017 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 10 : python3.14 (RHSA-2026:77018)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77018 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RockyLinux 8 : python3.12 (RLSA-2026:77028)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77028 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

CVE-2026-107275: Detection of Error Condition Without Action

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3903)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free vulnerability exists in libcurl when an applicationx000D configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS orx00...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3969)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free vulnerability exists in libcurl when an applicationx000D configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS orx00...

PT-2026-108318

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A flaw exists where a user working within a malicious project can bypass the intended checksum verification. This occurs when the project defines a bogus golang.org/toolchain entry in the go.sum...

CVE-2026-88647

A hostname verification bypass in GnuTLS v3.8.13 allows an attacker to circumvent the Common Name fallback mechanism using a crafted certificate. This flaw can lead to information disclosure by enabling an attacker to eavesdrop on or intercept encrypted network communications. Impacts have been i...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper hostname verification in the certificate validation process. An attacker can gain unauthorized access to sensitive information by presenting a crafted certificate that bypasses the Common Nam...

Security Bulletin: Due to use of Golang Go, multiple vulnerabilities affect IBM Cloud Pak System

Summary Due to use of Golang Go multiple vulnerabilities affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2026-39827 DESCRIPTION: An authenticated SSH client that repeatedly opened channels which were rejected by the server...

CVE-2026-92543

A flaw was found in Docker Engine. This vulnerability can lead to information disclosure or container image tampering by allowing an attacker to intercept unencrypted registry traffic. The flaw exists because the engine disables Transport Layer Security TLS certificate verification if any resolve...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...