ROS-20260714-73-0066

The vulnerability of the modproxyajp module in the Apache HTTP Server is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-60083

Name of the Vulnerable Software and Affected Versions MKP affected versions not specified Description The MKP server contains a memory exhaustion issue that allows an unauthenticated remote attacker to cause a denial of service. The get resource MCP tool proxies Kubernetes pod log requests but...

PT-2026-58108

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Nexus Repository 3 fails to apply Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. SSRF is a flaw that allows an...

CVE-2026-61520: Server-Side Request Forgery (SSRF)

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

CVE-2026-47736: Uncontrolled Resource Consumption

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

CVE-2026-50480: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

CVE-2026-14646: Server-Side Request Forgery (SSRF)

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

CVE-2026-49800: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

PT-2026-58172

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An integer overflow or wraparound in the Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no...

EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-2699)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2684)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...

ROS-20260714-73-0059

The vulnerabilities of the ngxhttpproxyv2module and ngxhttpgrpcmodule modules in NGINX Plus and NGINX Open Source web servers are related to the execution of operations outside of the buffer in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code or cause...

How to Configure HTTP Proxy for Windows-based Veeam Components

Purpose This article explains how to configure an HTTP proxy for Windows-based Veeam components when the server must reach the internet through a proxy. It applies to Veeam products installed on Windows, including Veeam Backup & Replication, Veeam Cloud Connect, Veeam ONE, Veeam Service Provider...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-2653)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects Apache...

EulerOS 2.0 SP10 : openssh (EulerOS-SA-2026-2705)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.CVE-2026-35388 In OpenSSH before 10.3, comman...

EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-2658)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2644)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the instance registration and proxy handling in InstanceRegistry and InstanceWebProxy. An attacker can make the server send outbound HTTP requests to arbitrary internal addresses and exfiltrate...

CVE-2026-62242

CVE-2026-62242 affects Spring Boot Admin Server prior to 4.1.2. The vulnerability is a server-side request forgery in the unauthenticated instance registration flow, where attacker-controlled healthUrl and managementUrl are not validated against private IP ranges or metadata endpoints. This allow...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...