CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) is vulnerable to identity spoofing via dot-form header aliasing in versions v1.x, v2.x–v2.11.55, and v3.0.0–v3.7.11. Because Go canonicalizes header names on dashes only, a client can send a dot-form alias (e.g., X.Authenticated.User) alongside the c...

CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

PT-2026-89452

Name of the Vulnerable Software and Affected Versions Traefik versions 3.2.0 through 3.7.12 Description Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but fail to inspect req.Trailer. This allows an unauthenticated client to...

PT-2026-89459

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.26 through 2.11.56 Traefik versions 3.4.2 through 3.7.12 Description Traefik contains a request smuggling issue related to the handling of the HTTP/1.1 Upgrade mechanism. The software forwards client-supplied Connection...

PT-2026-89472

Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions prior to 2.11.56 Traefik versions 3.0.0 through 3.7.11 Description Traefik fails to properly handle request headers that act as aliases for other header names. While Go treats headers like...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

CVE-2026-84186

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186

This vulnerability affects PrestaShop and resides in the Tools::getRemoteAddr() function. When the application runs behind a reverse proxy, load balancer, or CDN, it incorrectly trusts the client-supplied X-Forwarded-For header instead of the IP provided by the trusted infrastructure, allowing an...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

EUVD-2026-72305

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186: Authentication Bypass by Spoofing

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

SUSE CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

SUSE CVE-2026-71326

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

SUSE CVE-2026-71327

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and...

EUVD-2026-57410

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy...

CVE-2026-73812

A flaw was found in the inets httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both Transfer-Encoding: chunked and Content-Length headers, failing to reject them or close the connection as required by RFC 9112 §6.1. When inets is deployed behind a...

Containous Traefik StripPrefix Bypass Access

The vulnerability of the intermediate software program StripPrefix of the Containous Traefik reverse proxy server relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain...

RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:62631)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62631 advisory. HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-U...

org.jenkins-ci.plugins:reverse-proxy-auth-plugin (>=1.3.3, <=1.6.3) potentially affected by CVE-2026-84662 via org.jenkins-ci.plugins:ldap (1.8)

org.jenkins-ci.plugins:ldap MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:ldap and may be impacted: - org.jenkins-ci.plugins:reverse-proxy-auth-plugin =1.3.3, =1.6.3 Source cves: CVE-2026-84662 Source advisory...