CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim prior to 4.100.1 is vulnerable to an out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy. The vulnerability is network-reachable with no required privileges but has high attack complexity , yielding a CVSS 3.1 base score of 7.0 (HIGH) with impacts of low confide...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

BIT-RCLONE-2026-88044 rclone: RC per-server auth-proxy bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

EUVD-2026-83503

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin, in versions before 1.1.5 , is vulnerable to a Reverse-Proxy Target Hijack via the set_unbounce_domains function. The flaw exists because the plugin fails to perform proper authorisation checks when updating the configuration for its front-end proxy. Th...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

CLEANSTART-2026-CU86688 Contour is a Kubernetes ingress controller using Envoy proxy

Security vulnerability affects the external-dns package. Contour is a Kubernetes ingress controller using Envoy proxy...

CVE-2026-94056: Use of Uninitialized Resource

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

CVE-2026-94054: Out-of-bounds Write

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-85574: Missing Authorization

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

PT-2026-95756

Name of the Vulnerable Software and Affected Versions Unbounce Landing Pages WordPress plugin versions prior to 1.1.5 Description An authorization bypass exists when updating the configuration used by the front-end proxy. This allows any authenticated user, including those with subscriber-level...

PT-2026-95880

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.100.1 Description When Proxy-Protocol is used with an attacker-controlled proxy, the software allows attackers to read certain uninitialized data from stack memory. Recommendations Update to version 4.100.1 or later...

PT-2026-95878

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.100.1 Description An out-of-bounds write occurs when Proxy-Protocol is used with a proxy controlled by an attacker. An out-of-bounds write is a memory corruption error where data is written outside the intended boundar...

Fedora 46 : python-streamlink / python-urllib3 (2026-3a61bdd470)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3a61bdd470 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

Linux Distros Unpatched Vulnerability : CVE-2026-85719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and...