CVE-2026-112377High· 7.4▾ TwilightCCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
attested-tls-poc <= 731ca82ed533fc7a1092be980887ae2e34261da2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-2182Medium· 6.5Ovn: insufficient validation of bfd packets may lead to denial of service
CVE-2026-112101Medium· 4.3BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
CVE-2026-108372High· 7.1LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
CVE-2026-109461Medium· 5.9Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
CVE-2026-55587High· 8.1AliasVault is a privacy-first password manager with built-in email aliasing
CVE-2026-55842Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams