CVE-2026-74882

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74894

The PHP package openssl_encrypt before version 1.4.0 has a broken verify_api_token function that accepts any non-empty Bearer token, allowing unauthenticated attackers to upload arbitrary public keys, enumerate all keys, and revoke any user's keys. CVSS 9.8 Critical. Upgrade to 1.4.0. No in-the-w...

CVE-2026-74882

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration

opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation i...

Signature Bypass

Apache CXF is vulnerable to signature Bypass. The vulnerability is due to insufficient verification of metadata signatures, where the JwsJsonContainerRequestFilter processes metadata without confirming it was authenticated by the accepted signature, and attackers can supply unauthenticated...

BIT-NODE-MIN-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-OPENBAO-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

K000162941: NodeJS vulnerability CVE-2026-58044

Security Advisory Description A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers...

ROS-20260817-73-0217

The vulnerability in Ruby is related to uncontrolled resource consumption due to filtering and reducing data to unsafe values during the processing of HTTP headers. Exploiting this vulnerability can allow an attacker to cause service failures, provided that the default configurations of...

CVE-2026-12630: Out-of-bounds Read

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

PT-2026-76618

openssl encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101118 advisory. A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a...

CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-68005: Uncontrolled Resource Consumption

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-101351)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101351 advisory. gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :pat...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099905)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099905 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: reject short IPv4/IPv6 inputs in bpfprogtestrunskb bpfprogtestrunskb calls ethtypetrans firs...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100190)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100190 advisory. In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101105)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101105 advisory. Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header...