grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

EUVD-2026-93490

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848

The @payloadcms/plugin-stripe component within the Payload headless content management system is vulnerable to insufficient access control in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . An authenticated user capable of reaching the enabled optional Stripe REST proxy can pe...

EUVD-2026-93458

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

CVE-2026-67270

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

CVE-2026-67270

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are affected by an Improper Certificate Validation vulnerability within the proxy-server component. An unauthenticated attacker located on an adjacent network could exploit this flaw to cause information exposure of storage backend adm...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. "The unauthorized bot activities included edits to ou...

OPENSUSE-SU-2026:22026-1 Security update for prometheus-blackbox_exporter

This update for prometheus-blackboxexporter fixes the following issues: Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 bsc1279126 - CVE-2026-39821: Fix potential validation...

CVE-2026-8181

CVE-2026-8181 익스플로잇 Burst Statistics WordPress 플러그인 — 인증 우회를 통한 관리자 권한 상승 CVE-2026-8181에 대한 익스플로잇으로, Chloe Chamberland와 PRISM이 발견했습니다. ⚠️ 고지 사항 이 저장소는 연구 및 방어적 보안 목적으로만 제공됩니다. 저자는 이 정보의 오용에 대해 책임을 지지 않습니다. 📌 개요 WordPress용 Burst Statistics – Privacy-Friendly WordPress Analytics 플러그인은 3.4.0부터...

NimDllSideload

Nim DLL Sideloading 이 저장소는 사이드로딩/프록시 로딩에 사용할 수 있는 Nim DLL을 쉽게 생성할 수 있게 해줍니다. DLL 사이드로딩이 무엇인지 잘 모르신다면 이 블로그 게시물을 살펴보세요. 어떻게 사용하나요? 프록시하려는 정상 DLL또는 여러 DLL을 이 저장소의 build 디렉터리에 넣은 다음 make를 실행하세요. 그러면 out 디렉터리에 두 개의 .dll 파일이 생성됩니다: 무작위 이름을 가진 파일은 함수 호출이 프록시될 원본 DLL입니다. 다른 하나는 페이로드입니다. 사이드로딩이 성공하면 메시지...

CVE-2026-105486

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. id: CVE-2020-17506 info: name: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection author:...

litellm-sqli-scanner

LiteLLM SQL 인젝션 스캐너 CVE-2026-42208 — LiteLLM 프록시의 SQL 인젝션 CVE-2026-42208LiteLLM 프록시 데이터베이스 계층의 SQL 인젝션 취약점을 탐지하고 검증합니다. 승인된 보안 테스트에만 사용하십시오. 기능 CVE-2026-42208 SQL 인젝션 탐지 LiteLLM 프록시 버전 핑거프린팅 PoC 검증 페이로드 구조화된 JSON / 텍스트 출력 요구 사항 Python 3.8+ 사용법 python litellmscanner.py --url http://target:4000 Sca...

EUVD-2026-92916

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...