https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T11:55:30.711509+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bell-cve-2026-91769 BELL-CVE-2026-91769 2026-09-28T11:55:30.716795+00:00

Affected: Alpaquita:25: php83, Alpaquita:stream: php83

 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1227 certfr-2026-avi-1227 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque… 2026-09-28T11:55:30.716929+00:00 certfr-2026-avi-1227 https://vulnerability.circl.lu/vuln/fkie_cve-2026-91769 fkie_cve-2026-91769 2026-09-28T11:55:30.716982+00:00

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-91769 UBUNTU-CVE-2026-91769 2026-09-28T11:55:30.717052+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.04:LTS: php8.5

[Unknown description]