HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67598 — Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerab...

·Source: NIST NVD

Updated:

Executive Summary

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSe

Analysis

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers. CVSS Score: 7.4. Published: 2026-08-03T20:17:27.960.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67598
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Amgen Tells SEC Hack Exposed Patient Data, Trade Secrets

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/amgen-tells-sec-hack-exposed-patient-data-trade-secrets-image_small-6-a-32401.jpg" align=right hspace=4><b>Drug Maker Says PHI, Research, Confidential Business Data Potentially Stolen</b><br>Pharmaceutical maker Amgen has notified the U.S. Securities and Exchange Commission that cybercriminals have potentially stolen a cache of se

Bank Info Security
MEDIUMVulnerabilityNEW

Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Over the weekend, the vendor discovered another vector of authentication bypass CVE-2026-18577 that gives attackers administrator access.

CVE-2026-18577
Dark Reading
HIGHVulnerability

NVD HIGH: CVE-2026-41447 — FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that...

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege lev

CVE-2026-41447
NIST NVD