PULSEUnderground Intel

EN VIVO38señales / 24h

FEED

ransomsilentransomgroup reclama a A&O Shearman · GB · Professional Servicesransomsilentransomgroup reclama a J...ransomhyflock reclama a tcadarwin · AU · Otherransombyod reclama a Providence · Healthcareransombyod reclama a Toyota · JP · Manufacturingransomorova reclama a Herminio India Precision Technology · IN · Manufacturingransomkrybit reclama a Actualize Consulting · US · Professional Servicesransomclimax inc reclama a Redacted Redactedransomclimax inc reclama a Nepal Electricity Authority · NP · Energy & Utilitiesransomclimax inc reclama a Frolina Home · BR · Retail & E-Commerceransombooba project reclama a COMPUTER TASK GROUP, Inc. · US · Technologyransombooba project reclama a Georgetown Sleep Center · US · Healthcareransombooba project reclama a Collier Sports Medicine and Orthopedic Center · US · Healthcareransombooba project reclama a El Portal Imaging Center · MX · Healthcareransomsilentransomgroup reclama a A&O Shearman · GB · Professional Servicesransomsilentransomgroup reclama a J...ransomhyflock reclama a tcadarwin · AU · Otherransombyod reclama a Providence · Healthcareransombyod reclama a Toyota · JP · Manufacturingransomorova reclama a Herminio India Precision Technology · IN · Manufacturingransomkrybit reclama a Actualize Consulting · US · Professional Servicesransomclimax inc reclama a Redacted Redactedransomclimax inc reclama a Nepal Electricity Authority · NP · Energy & Utilitiesransomclimax inc reclama a Frolina Home · BR · Retail & E-Commerceransombooba project reclama a COMPUTER TASK GROUP, Inc. · US · Technologyransombooba project reclama a Georgetown Sleep Center · US · Healthcareransombooba project reclama a Collier Sports Medicine and Orthopedic Center · US · Healthcareransombooba project reclama a El Portal Imaging Center · MX · Healthcare

← Todos los CVEs

CVE Watch10 nov 2026

CVE-2026-42067

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-295

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Referencias oficiales

intel.comhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1208087.4 ALT

——0An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.3h CVE-2026-959106.7 MED

——0Improper certificate validation in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.4h CVE-2026-1253367.4 ALT

——0Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3.4h CVE-2026-1055905.3 MED

——0Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.4h CVE-2026-825097.4 ALT

——0V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.9h CVE-2026-112165—

——3The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.1d