Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,295

Export CSV
CVE-2023-0464

Excessive Resource Usage Verifying X.509 Policy Constraints

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Core Services and 1 more
CVE-2026-87663

Authentication Bypass and Root Command Injection in Brocade Fabric OS Remote Execution Service

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Brocade
Products
Fabric Operating System Fabric Os
CVE-2026-87425

TLS Client Trust Store Modification Enabling MITM

An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Active Support Connectivity Gateway
CVE-2026-34073

cryptography has incomplete DNS name constraint enforcement on peer names

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Pyca
Products
Cryptography Cryptography
CVE-2022-27782

curl: TLS and SSH connection too eager reuse

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Debian Haxx Redhat and 1 more
Products
Debian Linux Curl Enterprise Linux and 1 more
CVE-2026-42789

Non-CA certificate accepted as intermediate issuer in public_key path validation

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Erlang
Products
Erlang/otp Erlang\/otp Otp
CVE-2022-22576

curl: OAUTH2 bearer bypass in connection re-use

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2026-85432

MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-87686

Brocade Fabric OS Authentication Bypass via HTTP Host Header

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Brocade
Products
Fabric Operating System Fabric Os
CVE-2026-78020

Improper Certificate Validation in Dell SCG Policy Manager Enables Remote Exploitation

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2022-1343

OCSP_basic_verify may incorrectly verify the response signing certificate

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Netapp Openssl Redhat
Products
A250 A250 Firmware A700s and 41 more
CVE-2021-28363

python-urllib3: HTTPS proxy host name not validated when using default SSLContext

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Oracle Python and 1 more
Products
Fedora Peoplesoft Enterprise Peopletools Urllib3 and 1 more
CVE-2021-22926

curl: CURLOPT_SSLCERT mixup with Secure Transport

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

CVSS 3.1 · 7.5 High EPSS 15.1% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 23 more
CVE-2026-85974

Improper TLS hostname verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2021-22924

curl: Bad connection reuse due to flawed path name checks

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

CVSS 3.1 · 3.7 Low EPSS 6.3% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 5 more
Products
Debian Linux Fedora Libcurl and 52 more
CVE-2021-22897

curl: Cipher settings shared for all connections when using schannel TLS backed

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Cloud Backup H300e and 27 more
CVE-2021-22890

curl: TLS 1.3 session ticket mix-up with HTTPS proxy host

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 6 more
Products
Fabric Operating System Debian Linux Fedora and 9 more
CVE-2020-13529

systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfigured

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Active Iq Unified Manager Cloud Backup and 2 more
CVE-2020-8286

curl: Inferior OCSP verification

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Mac Os X Macos Debian Linux and 19 more