CVE Watch16 de out. de 2026

CVE-2026-108361

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker

CVSS

—

Sem CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 12 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-367

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-10-132026-11-06

Descrição técnica

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-634405.9 MÉD

—

———2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.6h CVE-2026-1238355.9 MÉD

—

——0In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition7h CVE-2026-1234865.3 MÉD

—

——0WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.12h CVE-2026-1129133.3 BAI

1.7%

——1filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use _connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to place a database-wal or database-journal side file before acquisition. An undeletable WAL file makes each read or write acquisition fail immediately with sqlite3.OperationalError regardless of timeout. Separately, when the database contains at least one table, a hot journal that grants the lock account modify rights can cause SQLite recovery to delete a file named by that journal only when the lock account has permission to delete the target. The issue requires a directory writable by another account, such as a shared Windows temporary directory, and does not affect private directories. This issue is fixed in version 4.2.1.5h CVE-2026-1232073.1 BAI

15.1%

——5LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.1d CVE-2026-1121106.3 MÉD

1.1%

——0A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory. This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).6h