🔍 Zero Day Initiative
ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
#ZeroDay #Vulnerability
ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
#ZeroDay #Vulnerability
🔍 Zero Day Initiative
ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.
#ZeroDay #Vulnerability
ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.
#ZeroDay #Vulnerability
🔍 Zero Day Initiative
ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating...
#ZeroDay #Vulnerability
ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating...
#ZeroDay #Vulnerability
⚠️ CERT/CC Vulnerability Notes
COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to...
#Advisory #Vulnerability
COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to...
#Advisory #Vulnerability
kb.cert.org
CERT/CC Vulnerability Note VU#128947
COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
📰 BleepingComputer
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]
#CyberNews #Infosec
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]
#CyberNews #Infosec
BleepingComputer
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models.
🔴 CVE Digest — 26 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-110720 · CVSS 9.9
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding...
🔴 CVE-2026-10757 · CVSS 9.8
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-110720 · CVSS 9.9
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding...
🔴 CVE-2026-10757 · CVSS 9.8
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-110720 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0…
📰 BleepingComputer
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]
#CyberNews #Infosec
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]
#CyberNews #Infosec
BleepingComputer
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
📰 Dark Reading
Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
#CyberNews #Infosec
Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
#CyberNews #Infosec
Dark Reading
Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia's Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
📰 Dark Reading
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
#CyberNews #Infosec
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
#CyberNews #Infosec
Dark Reading
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
AI coding agents may act on instructions embedded in local markdown files, exposing new risks around trust, configuration, and credentials.
📰 BleepingComputer
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
#CyberNews #Infosec
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
#CyberNews #Infosec
BleepingComputer
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
🔴 CVE Digest — 26 Oct 2026
4 critical vulnerabilities
🔴 CVE-2026-116747 · CVSS 9.2
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-116506 · CVSS 9.9
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the...
🔴 CVE-2026-116505 · CVSS 9.1
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the...
🔴 CVE-2026-116504 · CVSS 9.9
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW...
#CVE #Critical #Vulnerability
4 critical vulnerabilities
🔴 CVE-2026-116747 · CVSS 9.2
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-116506 · CVSS 9.9
A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the...
🔴 CVE-2026-116505 · CVSS 9.1
A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the...
🔴 CVE-2026-116504 · CVSS 9.9
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-116747 - Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator…
⚠️ CERT/CC Vulnerability Notes
mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation
Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an...
#Advisory #Vulnerability
mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation
Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an...
#Advisory #Vulnerability
kb.cert.org
CERT/CC Vulnerability Note VU#701544
mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation
📰 Dark Reading
So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring AI model security gets complex fast — a growing patchwork of benchmarks targets different variables in the equation, but none replace testing against your own code and workflows.
#CyberNews #Infosec
So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring AI model security gets complex fast — a growing patchwork of benchmarks targets different variables in the equation, but none replace testing against your own code and workflows.
#CyberNews #Infosec
Dark Reading
So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring the cybersecurity of AI models gets complex fast, with metrics focused on different variables in the AI security equation.
🔴 CVE Digest — 27 Oct 2026
1 critical vulnerability
🔴 CVE-2026-116508 · CVSS 10.0
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-116508 · CVSS 10.0
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-116508 - TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results…
📰 BleepingComputer
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
#CyberNews #Infosec
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
#CyberNews #Infosec
BleepingComputer
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.
🔴 CVE Digest — 27 Oct 2026
1 critical vulnerability
🔴 CVE-2026-18450 · CVSS 9.8
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-18450 · CVSS 9.8
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-18450 - Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
📰 BleepingComputer
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]
#CyberNews #Infosec
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]
#CyberNews #Infosec
BleepingComputer
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
📰 BleepingComputer
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
#CyberNews #Infosec
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
#CyberNews #Infosec
🔴 CVE Digest — 27 Oct 2026
21 critical vulnerabilities
🔴 CVE-2026-82117 · CVSS 9.8
Authentication Bypass by Spoofing Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00...
🔴 CVE-2026-82116 · CVSS 9.8
Missing Authentication for Critical Function Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from...
🔴 CVE-2026-82118 · CVSS 9.8
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-82120 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-82119 · CVSS 9.8
OS Command Injection Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01;...
🔴 CVE-2026-82122 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-76939 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76936 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76937 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76938 · CVSS 9.8
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job...
🔴 CVE-2026-76935 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76934 · CVSS 9.8
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76932 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76933 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-86577 · CVSS 9.4
Out-of-bounds Write Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from...
🔴 CVE-2026-86576 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager:...
🔴 CVE-2026-86575 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager:...
🔴 CVE-2026-86574 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in JP1/Base.
This issue affects JP1/Base: from 11-00 before 12-50-54.
🔴 CVE-2026-102788 · CVSS 9.3
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox
🔴 CVE-2026-102789 · CVSS 9.3
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox
#CVE #Critical #Vulnerability
21 critical vulnerabilities
🔴 CVE-2026-82117 · CVSS 9.8
Authentication Bypass by Spoofing Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00...
🔴 CVE-2026-82116 · CVSS 9.8
Missing Authentication for Critical Function Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from...
🔴 CVE-2026-82118 · CVSS 9.8
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-82120 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-82119 · CVSS 9.8
OS Command Injection Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01;...
🔴 CVE-2026-82122 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before...
🔴 CVE-2026-76939 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76936 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76937 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76938 · CVSS 9.8
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job...
🔴 CVE-2026-76935 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76934 · CVSS 9.8
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76932 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-76933 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic...
🔴 CVE-2026-86577 · CVSS 9.4
Out-of-bounds Write Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from...
🔴 CVE-2026-86576 · CVSS 9.4
Heap-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager:...
🔴 CVE-2026-86575 · CVSS 9.4
Stack-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager:...
🔴 CVE-2026-86574 · CVSS 9.8
Heap-based Buffer Overflow Vulnerability in JP1/Base.
This issue affects JP1/Base: from 11-00 before 12-50-54.
🔴 CVE-2026-102788 · CVSS 9.3
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox
🔴 CVE-2026-102789 · CVSS 9.3
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-82117 - Authentication Bypass by Spoofing Vulnerability in HiRDB
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V;…
🔴 CVE Digest — 27 Oct 2026
3 critical vulnerabilities
🔴 CVE-2026-115216 · CVSS 9.1
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator...
🔴 CVE-2026-112362 · CVSS 9.1
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when...
🔴 CVE-2026-117532 · CVSS 9.8
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-115216 · CVSS 9.1
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator...
🔴 CVE-2026-112362 · CVSS 9.1
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when...
🔴 CVE-2026-117532 · CVSS 9.8
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-115216 - Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth…