CVE-2026-46452 Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-46452

An Improper Input Validation vulnerability exists in Apache NimBLE (versions through 1.9.0) within the Mesh Proxy SAR reassembly process. The root cause involves an unbounded append and unchecked failure, which can lead to the transmission of broken data to the application. This flaw may result i...

EUVD-2026-48559

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

CVE-2026-16730

dbus-broker is affected. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are treated as fatal, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to t...

CVE-2026-16730 Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

node9-proxy v1.63.0

🛡️ Node9 What did your AI agent actually do? Find out. Node9 sits between your AI agent and the tools it can use — discover what it's already been doing, protect against risky actions in real time, and review what happened over any time window. Works with Claude Code · Codex CLI · Antigravity agy ...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

EUVD-2026-48467

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

SUSE CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

EUVD-2026-48446

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-46452: Improper Input Validation

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

PT-2026-64284

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0 Description Improper input validation in the Mesh Proxy SAR reassembly process can lead to the transmission of corrupted data to the application. This may cause memory pressure and unstable parsing...

PT-2026-64225

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-66339: Insertion of Sensitive Information Into Sent Data

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339: Insertion of Sensitive Information Into Sent Data

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

PT-2026-64408

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes RHACM affected versions not specified multicluster-engine MCE affected versions not specified Description A flaw exists in the cluster-proxy service-proxy component. The service-proxy appends...

PT-2026-67583

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

PT-2026-71721

Name of the Vulnerable Software and Affected Versions OpenDJ versions prior to 5.1.2 Description The SASL PLAIN authorization identity path in the PlainSASLMechanismHandler.java file fails to evaluate the mayProxy proxy ACI Access Control Instruction scope when an authorization identity resolves ...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...