31223 matches found
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-69243 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2026-69244 via aiohttp (1.1.5)
aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...
devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-69243 via aiohttp (1.1.4)
aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-69243 Source advisory: OSV:PYSEC-2026-3546...
ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2026-69243 via aiohttp (2.2.3)
aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2026-69243 Source...
ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2026-59881 via aiohttp (2.2.3)
aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2026-59881 Source...
botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-59881 via aiohttp (1.1.6)
aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-59881 Source advisory: OSV:PYSEC-2026-3547...
devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2026-59881 via aiohttp (1.1.4)
aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2026-59881 Source advisory: OSV:PYSEC-2026-3547...
PYSEC-2026-3600 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
SummaryThe terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...
modusa (>=0.3.85, <=0.4.29), tubefeed (3.0.1) +3 more potentially affected by CVE-2026-55404 via yt-dlp (2025.9.23)
yt-dlp PYPI version 2025.9.23 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - modusa =0.3.85, =0.4.29 - tubefeed 3.0.1 - youtube-colab-proxy 1.0.2 - yt-queue 0.11.17 - ytdl-sub 2025.9.24 Source cves: CVE-2026-55404 Source...
PYSEC-2026-3597 open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. SummaryThe fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote passe...
MDEV-40470
MDEV-40470 — MariaDB 0day: GRANT PROXY privilege escalation +...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
agent-vault v0.39.1
HTTP credential proxy and vault An open-source credential broker by Infisical that sits between your agents and the APIs they call. Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access. New here? Thelaunch blog post has the full story...
CVE-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
EUVD-2026-52490
A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...
PT-2026-75453
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.1...
CVE-2026-70367: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...