curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75054

JetBrains IntelliJ IDEA before 2026.2.1 is vulnerable to server-side request forgery (SSRF) via the OpenAPI preview proxy when processing untrusted projects. The flaw allows internal network probing and potential access to local services, with HIGH confidentiality impact and MEDIUM CVSS 6.3 sever...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

EUVD-2026-60165

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-74998

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 fail to validate CSS proxy responses, enabling XSS or information disclosure through MIME sniffing. CVSS 7.2 (HIGH), network-reachable with no privileges. No in-the-wild exploitation reported. Fix: upgrade to 1.6.18 or 1.7.3 (commits...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

CVE-2026-74998

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

GHSA-X8P6-569W-FMMR Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3cc2-h3v6-rqpq. This link is maintained to preserve external references. Original Description SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/pro...

Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3cc2-h3v6-rqpq. This link is maintained to preserve external references. Original Description SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/pro...

CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74802 SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...