79 matches found
EulerOS Virtualization 2.15.0 : python-pip (EulerOS-SA-2026-4846)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...
CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though...
Linux Distros Unpatched Vulnerability : CVE-2026-111755
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name...
CVE-2026-111755: Incorrect Regular Expression
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...
EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-4086)
According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...
Sensitive Information Disclosure
Docling is vulnerable to sensitive information disclosure. The vulnerability is due to the HTML image resource loader forwarding configured headers to remote image URLs without restricting them to the source document’s origin, which allows an attacker to expose configured credentials, such as API...
PYSEC-2026-4189
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/imageresourceloader.py forwards headers configured through the HTMLBackendOptions.heade...
BIT-LIBPHP-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
Rocky Linux 8 [CIQ] Security Update: python3-urllib3 (crlsa-2026_36732)
The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202636732 advisory. urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44431 Tenable has extracted the preceding description blo...
Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2024_3259)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243259 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 golang: net/http/cookiejar: incorrect forwarding of...
CVE-2026-91766
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
CVE-2026-91766
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
CVE-2026-91766
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed...
CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...
EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-3666)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...
GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone
rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...
Security Bulletin: IBM DataPower Gateway affected by authentication bypass due to follow-redirects (CVE-2026-40895)
Summary IBM DataPower Gateway has addressed CVE-2026-40895 in versions 11.0.0.2, 10.6.0.10, 10.5.0.22 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to...
CVE-2026-88013
A flaw was found in rclone. The HTTP backend in rclone can forward custom or authentication headers, such as API keys, Authorization, or Cookie headers, when following redirects to a different host. This can lead to the disclosure of sensitive information to untrusted destinations. Additionally, ...