CVE-2026-83589

A flaw in oauth-proxy allows for an open redirect due to insufficient validation of the destination redirect parameter (rd) during post-login redirection. Specifically, the application may be susceptible to bypasses using // and / sequences. A remote attacker can exploit this by tricking a user i...

CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

zaproxy w2026-09-30

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...

ROOT-APP-MAVEN-CVE-2026-42578 CVE-2026-42578 in io.netty:netty-handler-proxy - Patched by Root

Root has patched CVE-2026-42578 in the io.netty:netty-handler-proxy package for Root:Maven. Multiple fixed versions available...

[SECURITY] Fedora 44 Update: xdg-dbus-proxy-0.1.9-1.fc44

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts...

CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

PT-2026-105822

Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramet...

PT-2026-105830

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user api key auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

Rocky Linux 10.2 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54486)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654486 advisory. FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow CVE-2026-64620 FreeRDP: FreeRDP: Double-free vulnerability...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785925031)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785925031 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785925784)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785925784 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

Rocky Linux 9 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (crlsa-2026_69126)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669126 advisory. curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to uncleared proxy authentication state...

Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54487)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 (crlsa-2024_9457)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249457 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54485)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654485 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

PT-2026-105197

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback users, causing t...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel Multiple Vulnerabilities (crlsa-2020_4743)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204743 advisory. squid: Improper input validation in request allows for proxy manipulation CVE-2019-12520 squid: Off-by-one error in addStackElement allows for heap buffer...

CVE-2026-83589: URL Redirection to Untrusted Site

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

PT-2026-103760

Name of the Vulnerable Software and Affected Versions oauth-proxy affected versions not specified Description The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this by enticing a user to follow a specially...

PT-2026-105918

Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxy ssl context, proxy assert hostname, and proxy assert fingerprint configure the TLS connection to the proxy. ssl context and the other target-specific TLS parameters configure the connection to th...