AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776763201)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776763201 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

CentOS Linux 8.4 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (CENTOS8.4:CLSA-2026:1790290861)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790290861 advisory. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. CVE-2026-94054 Note that...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1781093705)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781093705 advisory. - When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779357790)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779357790 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections s...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779357790)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779357790 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections...

AlmaLinux 9.2 [TuxCare] Security Update: xdg-dbus-proxy (ALMALINUX9.2:CLSA-2026:1789132992)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789132992 advisory. - xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787062885)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787062885 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the...

Linux Distros Unpatched Vulnerability : CVE-2026-97687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs,...

Linux Distros Unpatched Vulnerability : CVE-2026-100663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special- case HTTP/1 CONNECT authority-form request-targets when...

Linux Distros Unpatched Vulnerability : CVE-2026-101898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy setting...

SUSE CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-86105

An improper authorization vulnerability exists in the Fireware OS Access Portal reverse proxy. This flaw allows an authenticated, low-privileged Access Portal user to access unauthorized web applications by sending a specially crafted request for a different resource they are permitted to access....

CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-76835

A flaw was found in oauth2-proxy. When configured in reverse-proxy mode without explicit trusted proxy settings, the application defaults to treating all incoming network traffic as originating from trusted proxies. A remote, unauthenticated attacker can exploit this issue by sending a request wi...

CVE-2026-85719

A flaw was found in AsyncHttpClient. This vulnerability allows an attacker to expose SOCKS proxy credentials to the origin server when using an authenticated SOCKS proxy. This occurs because the library attaches Proxy-Authorization headers without verifying if the request is being sent to an HTTP...

CVE-2026-97687

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...

AZL-105909 CVE-2026-97687 affecting package tensorflow 2.16.1-11

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

AZL-105678 CVE-2026-97687 affecting package python-virtualenv 20.36.1-6

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...