EUVD-2026-46779

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

PT-2026-63360

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6 Description Traefik fails to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references, as the allowlist was only applied to...

PT-2026-63471

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This failure in...

PT-2026-63508

Name of the Vulnerable Software and Affected Versions IP Login affected versions not specified Description The IP Login extension for Joomla trusts forwarded client-IP headers without requiring a configured trusted proxy. This allows attackers to spoof the IP address used for automatic login, whi...

PT-2026-63564

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...

CVE-2026-13067: Incorrect Authorization

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-54478: Authentication Bypass by Spoofing

In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...

PT-2026-63386

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.18.0 through 1.25.1 Description When the software listens on a 'proxy-protocol-port' interface with answer-cookie: yes, the RFC 9018 server-cookie SipHash is computed using the proxy's wire address rather than the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

CVE-2026-61226

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: RTP Proxy. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

CVE-2026-60431

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: modproxy. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Whil...

CVE-2026-60364

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2026-60365

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party Web Servers. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

DEBIAN-CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

EUVD-2026-46361

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the "HAProxyMessageDecoder" in Netty's "codec-haproxy" module performs protocol version detectio...