29853 matches found
CVE-2026-94056
A flaw was found in Exim. When the Proxy-Protocol is used with an attacker-controlled proxy, an attacker can read certain uninitialized data from stack memory. This information disclosure could potentially expose sensitive data. Mitigation To prevent information disclosure, ensure that Exim is no...
CVE-2026-63199
A flaw was found in Perses, an open-source dashboard and visualization project. A low-privilege user with datasource creation rights can exploit a missing authorization check in the datasource proxy. This allows the user to attach a project or global secret they cannot otherwise read and cause...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK
Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS
Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...
[SECURITY] [DLA 4791-1] memcached security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 23, 2026 https://wiki.debian.org/LTS -...
curl security update
8.12.1-4.6 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix netrc password lookup for non-matching login CVE-2026-8926 8.12.1-4.5 - fix proxy auth not cleared properly on NULL CVE-2026-9079 - fix...
PT-2026-97535
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...
CVE-2026-77756: Inconsistent Interpretation of HTTP Requests
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...
Oracle Linux 10 : curl (ELSA-2026-69125)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69125 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix...
Debian dla-4791 : memcached - security update
The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4791 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected]...
PT-2026-97319
Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can modify the proxy settings of the application. Recommendations Update to a version later than 182000...
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows unauthenticated...
CVE-2026-96770: Improper Following of a Certificate's Chain of Trust
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...
CVE-2026-86683: Improper Input Validation
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
Debian dsa-6510 : xdg-dbus-proxy - security update
The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6510 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6510-1 [email protected] https://www.debian.org/security/ Albert...
Linux Distros Unpatched Vulnerability : CVE-2026-62987
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses...
Linux Distros Unpatched Vulnerability : CVE-2026-94422
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - xdg-dbus-proxy - None Ubuntu Linux - security update CVE-2026-94422 Note that Nessus relies on the presence of the package as reported by the...
RLSA-2026:69126 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
CVE-2026-88011
A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems like CGI, WSGI, PHP, and NGIN...
