OPENSUSE-SU-2026:22133-1 Security update for tinyproxy

This update for tinyproxy fixes the following issues: Changes in tinyproxy: - Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding boo1268474, CVE-2026-54387 - Fixed failure to reject requests containing multiple Content-Length headers with differing values boo1268475,...

pfBlockerNg-CVE-2022-40624

pfBlockerNg-CVE-2022-40624 Background pfBlockerNG is the Next Generation of pfBlocker with the following features: 1. Manage IPv4/v6 List Sources into 'Deny, Permit or Match' formats. 2. GeoIP database by MaxMind Inc. GeoLite2 Free version. 3. De-Duplication, Suppression, and Reputation...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111450

The Wheels framework (versions through 4.1.1 ) is vulnerable to an issue where it derives the default production error-email address from the Host header of the initial request starting the application. If an explicit recipient is not configured and a mail server is active, an attacker can trigge...

EUVD-2026-102603

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111385

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

EUVD-2026-102566

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385

Nezha versions 2.1.0 before 2.3.15 are vulnerable to a Host Header Injection in the mintTransferTool component. The vulnerability occurs because the application builds fs.download_url and fs.upload_url transfer URLs using an unvalidated Host header . An attacker controlling the Host header in a v...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

CVE-2026-111450: Use of Less Trusted Source

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

EEF-CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Summary Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit...

tenda-hg10-rce

CVE-2026-1689 Summary A command injection vulnerability exists in the Tenda HG10 router. It occurs in the formLogin endpoint due to improper handling of the Host parameter. No authentication credentials are verified as this executes before the check. User input from the Host header is directly...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. This issue can lead to a situation where the HTTP Host header is controlled by an attacker, due to a mismatch between the Host field and its corresponding authority value being mishandled...

Astra Linux – Vulnerability in Tomcat9

Improper input validation vulnerability. This issue affects Apache Tomcat: versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112. The following versions were at the end of their support lifecycles at the time the CVE was created, but are still affected: 8.5.0...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...