Rocky Linux 8 [CIQ] Security Update: PyYAML-debugsource / numpy-debugsource / python-cffi-debugsource / etc (crlsa-2025_4791)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20254791 advisory. modwsgi: Trusted Proxy Headers Removing Bypass CVE-2022-2255 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note tha...

Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54487)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784123512)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1784123512 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the...

PT-2026-105828

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate user of the file litellm/proxy/auth/login utils.py of the component PROXY ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1773312266)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773312266 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2025:1755115606)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1755115606 advisory. - Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

PT-2026-105822

Impact Any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramet...

PT-2026-105916

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

PT-2026-103937

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.68 Description An issue exists involving the inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling. This occurs via the mod proxy uwsgi module when processing a...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

PT-2026-103934

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description Improper validation of the FTP PASV reply address in the mod proxy ftp module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host...

PT-2026-105826

Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an api base inside the user config request body, bypassing the existing parameter guard. Details LiteLLM Proxy validates request bodie...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2026:1777035141)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777035141 advisory. - A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1790248981)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790248981 advisory. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The...

Rocky Linux 8 [CIQ] Security Update: python3-requests (crlsa-2023_4520)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20234520 advisory. python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: xdg-dbus-proxy (ALMALINUX9.6:CLSA-2026:1789126805)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789126805 advisory. - xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel (CENTOS7:CLSA-2026:1789779158)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789779158 advisory. - FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary...

AlmaLinux 9.6 [TuxCare] Security Update: xdg-dbus-proxy (ALMALINUX9.6:CLSA-2026:1789126805)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789126805 advisory. - xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop...

AlmaLinux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (ALMALINUX9.6:CLSA-2026:1790870694)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790870694 advisory. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fro...