CVE-2026-96770 s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

EUVD-2026-85567

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-96770

The s2s-proxy software is vulnerable in all published versions through 0.2.2 (specifically versions 0.1.16 through 0.2.2 ). The root cause is that TLS server listeners use Go's RequireAnyClientCert mode while skipCAVerification is set to false. This configuration validates that the client possess...

CVE-2026-96770 s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-96770 s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.80...

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Summary 9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows...

GHSA-X5C9-V98J-722R 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Summary 9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows...

SUSE CVE-2026-93564

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

SUSE CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

[SECURITY] [DSA 6510-1] xdg-dbus-proxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6510-1 [email protected] https://www.debian.org/security/ Alberto Garcia September 23, 2026 https://www.debian.org/security/faq -...

CVE-2026-86683

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683

ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a Broken Authentication issue. This flaw allows a low-privileged user to unauthorizedly modify the proxy settings . The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) , with potential impacts on confiden...

EUVD-2026-85291

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683 Broken Authentication Vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683 Broken Authentication Vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

DEBIAN-CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

UBUNTU-CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...