📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

PT-2026-68189

Name of the Vulnerable Software and Affected Versions openshift/oauth-proxy affected versions not specified Description A flaw exists where the proxy fails to strip client-supplied identity headers on paths configured to bypass authentication via the skip-auth-regex setting. This allows an...

PT-2026-67961

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.1 Description The proxy server Accept header parser uses a regular expression with a qdtext pattern ?:^"|. that is susceptible to catastrophic backtracking, a type of Regular Expression Denial of Service...

CVE-2026-71310: Uncontrolled Resource Consumption

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-69111: Missing Authentication for Critical Function

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

PT-2026-68329

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description The shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses using http.ReadResponse over an unrestricted buffered reader. This allows a malicious or compromised proxy, or an...

Linux Distros Unpatched Vulnerability : CVE-2026-71190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...

Linux Distros Unpatched Vulnerability : CVE-2026-67315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0...

OnionHop v3.7.8

OnionHop V3 OnionHop V3 is a modern, cross-platform desktop app Windows, macOS and Linux that routes your traffic through Tor. It can run Tor as a local SOCKS proxy or as a system-wide tunnel, automatically pick a working connection strategy for your network with Smart Connect , scan and apply...

Malicious code in streak-math-abz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25 The package advertises itself as a JavaScript day-math helper but its ESM main entry dist/index.mjs unconditionally spawns a bundled Linux x8664 ELF...

MAL-2026-11548 Malicious code in streak-math-abz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25 The package advertises itself as a JavaScript day-math helper but its ESM main entry dist/index.mjs unconditionally spawns a bundled Linux x8664 ELF...

CVE-2026-16728

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...

MAL-2026-11527 Malicious code in streak-metricsaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91054f07d768c0a8605fb644d2cc4003bb6a5d5b9502be2911d9090bc5a37d45 [email protected] presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copies a bundled binary...

Malicious code in streak-metricsaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91054f07d768c0a8605fb644d2cc4003bb6a5d5b9502be2911d9090bc5a37d45 [email protected] presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copies a bundled binary...

CVE-2026-54272 vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips, actions-runner, wazuh-dashboard, librechat,...

CVE-2026-69198 vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips, actions-runner, wazuh-dashboard, librechat,...

GHSA-22JQ-VG5J-6VGG vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips, actions-runner, wazuh-dashboard, librechat,...

GHSA-MWP4-54F8-5FHR vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips...

CVE-2026-69192 vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips...

GHSA-4XRF-JV44-H6HH vulnerabilities

Vulnerabilities for packages: unleash-fips, pulumi, prism, unleash-proxy, saf, graalvm, lerna, opensearch-dashboards, code-server, kubeflow-pipelines, unleash, sqlpad, renovate, npm, kibana, langfuse-fips, langfuse, wazuh-dashboard-fips, actions-runner, wazuh-dashboard, librechat,...