ALSA-2026:66542 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

CVE-2026-88018: Improper Authentication

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

HPESBMU05147 rev.1 - HPE IceWall products, Denial of Service vulnerability

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall Federation Agent 4.0 RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall Federation Proxy 4.0 RHEL8, RHEL9, RHEL10, Windows CVSS Scores: | CVE | CVSS Vector | Base Score | | -...

PT-2026-89452

Name of the Vulnerable Software and Affected Versions Traefik versions 3.2.0 through 3.7.12 Description Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but fail to inspect req.Trailer. This allows an unauthenticated client to...

CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

Exploit for Server-Side Request Forgery in Openclaw

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy B...

Server-Side Request Forgery (SSRF)

NLTK is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the destination when an HTTP proxy is configured, which allows an attacker to provide a validated public URL that the proxy redirects to an internal service, potentially exposing internal...

EUVD-2026-74627

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

A vulnerability exists in ProxyHandler within systems prior to SMR Aug-2026 Release 1 . Due to improper authorization , a local attacker can gain unauthorized access to the proxy configuration . While the vulnerability's impact is noted as high in certain metrics (CVSS 3.1), no specific exploits ...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

PT-2026-88963

Name of the Vulnerable Software and Affected Versions FortiPAM Chrome extension affected versions not specified Description An authentication procedure flaw in the Privileged Access Management extension allows remote attackers to compromise the confidentiality and integrity of protected...

ROS-20260909-73-0043

The vulnerability of the Proxy component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Security Advisory 0149

Security Advisory 0149 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73449 CVSSv3.1 Base Score: 5.9...

CVE-2026-21086: Improper Input Validation

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

PT-2026-88820

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

The vulnerability of the has_auth() function in the GRANT PROXY component of the MariaDB database management system allows a hacker to bypass existing security mechanisms and increase their privileges.

The vulnerability of the hasauth function in the GRANT PROXY component of the MariaDB database management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass existing security measures and gain increased privileges...