CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router...

CVE-2026-114656

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router...

CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router...

CVE-2026-114656

Traefik versions prior to 2.11.58 and 3.7.13 are susceptible to an authentication bypass vulnerability. The root cause is that negated Host matchers (e.g., !Host()) are incorrectly counted as served domains. This creates a TLS options conflict when a router rule is used, causing the system to fal...

EUVD-2026-107898

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router...

CLEANSTART-2026-JT86822 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...

EUVD-2026-107577

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

EUVD-2026-107576

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

PT-2026-121563

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds...

PT-2026-121555

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs...

LXC Incus backlink vulnerability

Versions prior to LXC Incus 6.0.7, from 6.1.0 up to versions prior to 7.0.2, and from 7.1.0 up to versions prior to 7.5.0 are affected by a backlink vulnerability. This vulnerability arises because malicious attackers can write host files by inserting symbolic links within transport volumes...

PT-2026-120969

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube user::query matched the address against identity records without qualifying the lookup by IMAP host, so a...

Red Hat: CVE-2026-115449: libslirp: libslirp: ICMP echo reply length desynchronization leaks host IP to guest

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

PT-2026-121553

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instan...

PT-2026-121333

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.7 webpack-dev-server version 6.0.0 Description When a proxy entry is configured to forward WebSockets, the server forwards non-HMR Hot Module Replacement WebSocket upgrade requests to the proxy target...

PT-2026-121594

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An authentication bypass in the SSH daemon allows an unauthenticated remote attacker to circumvent authentication controls. This can lead to the attacker gaining administrative privileges and...

PT-2026-121564

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of...

Bytecode Alliance wasmtime input validation error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 through 48.0.4 and 49.0.0 through 49.0.2 contain an input validation error vulnerability. This vulnerability arises because the Wasi: HTTP implementation allows a guest to set the “between-bytes-timeout” request option to 0 and then directly...

Bytecode Alliance wasmtime numeric error vulnerability

Bytecode Alliance: Versions prior to 36.0.16, versions 37.0.0 through 48.0.3, and versions 49.0.0 through 49.0.1 contain a numerical error vulnerability. This vulnerability arises when wasmtime-wasi processes filesystem timestamps; the subsecond field of the atim or mtim value overflows into the...

PT-2026-120938

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.58 Traefik versions prior to 3.7.13 Description An authentication bypass exists that allows unauthenticated clients to skip client-certificate checks. This occurs because negated Host matchers are counted as serv...