CVE-2026-14435

MediumCVSS 5.9/10Last modified Nov 9, 2026

Description

IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	Turbonomic kubeturbo agent	>= 8.16.0, <= 8.20.3

References

https://www.ibm.com/support/pages/node/7290683

Timeline

Published: Nov 8, 2026
Last modified: Nov 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-144376.5IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could CVE-2026-144399.4A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a CVE-2026-14442.4A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects an unknown part of t CVE-2026-144406.8Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CA CVE-2026-144416.9A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific use CVE-2026-144426.9An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application lo CVE-2026-144438.4Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared CVE-2026-144447.5The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to CVE-2026-144469.8IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.CVE-2026-144472.3In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to a CVE-2026-144487.2An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to im CVE-2026-144496.4u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components