Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,295

Export CSV
CVE-2026-54100

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform Openshift For Windows Containers and 2 more
CVE-2026-62367

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go-vikunja
Products
Vikunja
CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Python Urllib3
Products
Urllib3 Urllib3
CVE-2026-63697

Improper Certificate Validation in Dell System Update Allows Remote Code Execution

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
System Update
CVE-2026-109245

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-87670

Authorization Bypass via Spoofed HTTP Headers in Fabric OS REST API

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Brocade
Products
Fabric Operating System Fabric Os
CVE-2026-106584

openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-102671

Joyland AI WebView accepts invalid SSL certificates

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joyland
Products
Joyland.ai
CVE-2026-102669

Joyland AI hostname checking disabled

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joyland
Products
Joyland.ai
CVE-2026-96336

WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107318

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Fastify
Products
Fastify/reply-from
CVE-2026-107819

MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb
Products
Server
CVE-2026-84032

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-105794

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

CVSS 4.0 · 9.1 Critical EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Msquic
CVE-2026-102161

Security Advisory 0190

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Cloudvision Cue
CVE-2026-97146

Apache YuniKorn: Admission control bypass via system label forgery

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Yunikorn
CVE-2026-33586

Authenticated SMTP Sender Address Forgery

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ovhcloud
Products
Ovhcloud
CVE-2026-92542

Blind VXLAN injection into encrypted overlay networks from cluster peer

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria: - UDP datagram - Destination port is the Swarm data-path port - Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Docker Moby
Products
Docker Engine Docker Engine Overlay Network Driver Moby Overlay Network Driver
CVE-2026-107589

Authentication Bypass by Spoofing in Jacamar CI

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jacamar Ci
Products
Jacamar Ci
CVE-2026-107587

Improper Certificate Validation in hMailServer

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver