CVE-2023-54397: Inconsistent Interpretation of HTTP Requests

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

PT-2026-92445

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the proxy packet processing logic occurs when malformed or truncated input is improperly handled. An unauthenticated remote attacker can trigger an...

CVE-2026-76685: Integer Overflow or Wraparound

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

PT-2026-98962

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-83419: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2026-88065: Exposure of Sensitive Information to an Unauthorized Actor

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-55149: Memory Allocation with Excessive Size Value

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

CVE-2026-91992: Exposure of Sensitive Information to an Unauthorized Actor

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

ROS-20260915-73-0150

The vulnerability of the Proxy component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-97284

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.47 through 9.0.121 Apache Tomcat versions 8.5.67 through 8.5.100 Description An inconsistent interpretation of HTTP...

CVE-2026-83417: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physica...

CVE-2026-83418: Improper Access Control

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Difficult to exploit vulnerability allows low privileged attacker with network access via...

PT-2026-93125

Name of the Vulnerable Software and Affected Versions tts-be versions prior to 2.1.0 Description Broken Access Control exists across several API endpoints, including '/api/student/id/photo' and '/api/course unit/id/exchange/metadata'. By chaining these unauthenticated endpoints, a remote attacker...

CVE-2026-90711: Authentication Bypass by Spoofing

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

Linux Distros Unpatched Vulnerability : CVE-2026-90711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions...

PT-2026-91873

Name of the Vulnerable Software and Affected Versions proxy-addr versions 1.1.0 through 2.0.7 Description This Node.js module, which determines a request's client address behind trusted reverse proxies and supports Express req.ip and req.ips, contains a flaw where trust subnets written in...

PT-2026-98422

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-91143

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-73449

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...