undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
CVE-2026-109383
### Impact undici's `Agent` passes its constructor options through a JSON-based deep clone (`JSON.parse(JSON.stringify(
#cwe-295
共收录 447 条相关情报。
← 返回所有主题Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
CVE-2026-108326
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack a...
CVE-2026-41022
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could expl
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external ...
CVE-2026-115216
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contac
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to t...
CVE-2026-111459
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditi
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three ...
CVE-2025-13833
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root...
CVE-2026-115929
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root cer
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to...
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment en...
CVE-2026-114611
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle ...
CVE-2026-96375
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows...
CVE-2026-87944
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiT
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96375
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versi...
CVE-2026-87944
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiT
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's ...
CVE-2026-114642
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connect
Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper
CVE-2026-114642
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connect
SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
CVE-2026-87944
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiT
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
CVE-2026-96375
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signe...
CVE-2026-114406
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. ...
CVE-2026-111815
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate requir
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present ...
CVE-2026-111814
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one cl