PT-2026-115119

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description An issue exists in this HTTP client library for Node.js when an originless Agent composes redirect and cache interceptors in that specific order while using ...

CVE-2026-110865

A flaw was found in Renovate. This vulnerability allows an authenticated repository user to bypass HTTP Hypertext Transfer Protocol header restrictions by specifying custom headers within shared configuration presets. By injecting arbitrary headers into outbound requests sent by Renovate, an...

CVE-2026-110865

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

DEBIAN-CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868

Renovate versions before 44.79.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The issue allows users to force the shared HTTP client to request arbitrary internal URLs through extends presets or customDatasources . An attacker can exploit this by pointing a preset at an i...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865

Versions of Renovate before 44.60.1 are vulnerable to an HTTP Header Allowlist Bypass via shared presets. The root cause is the failure to validate hostRules[].headers within shared presets, allowing users to evade allowedHeaders restrictions. Attackers can provide internal or external presets to...

CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to HTTP header injection within their proxy functionality. The root cause is the failure to reject a lone LF character in the target portion of a routing token (specifically Cookie: msts= ). This allows the http_proxy_connect function to write t...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...