CVE-2026-71569 Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

EUVD-2026-112721

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

CVE-2026-71569

Apache Camel versions 4.21.0 before 4.22.2 are vulnerable to a Server-Side Request Forgery (SSRF) in the A2A component . The root cause is a discrepancy in how WebhookUrlValidator handles push notification webhook hosts: IP literals were checked against a prefix list (recognizing fc00::/7 ), whil...

CVE-2026-71569

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

Exploit for OS Command Injection in Collabora Online

CVE-2026-110447 - Nextcloud richdocumentscode RCE 1-day Una...

OESA-2026-4626 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...

OESA-2026-4627 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...

OESA-2026-4624 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to...

UA3F

UA3F English | 简体中文 UA3F is an HTTPS rewriting proxy that transparently rewrites HTTPS e.g., User-Agent as an HTTP, SOCKS5, TPROXY, REDIRECT, or NFQUEUE server. Supports bidirectional rewriting of HTTPS Headers and Body Supports HTTPS URL redirection: 302, 307, Header Supports HTTPS MitM traffic...

EUVD-2026-112489

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

PT-2026-132074

Server-Side Request Forgery SSRF vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of...

RockyLinux 9 : python-urllib3 (RLSA-2026:90494)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:90494 advisory. urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-97689 urllib3: urllib3: Traffic interception via HTTPS prox...

python3.12-urllib3 security update

1.26.19-5 - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 1.26.19-4 - CVE-2026-97687 Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282315...

RHEL 9 : python-urllib3 (RHSA-2026:90494)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90494 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Important: python3.12-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-106036: Krajowa Izba Rozliczeniowa Szafir: Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS…

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

Echo: HTTPS Redirect And HSTS Bypass Via Unconditional Trust Of Forwarded Scheme Headers

Description "Context.Scheme" unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted header...

harlogger

Description Installation Profile method for macOS host Howto Profile method for non-jailbroken devices Howto Secret preference method for jailbroken devices Howto Enable HTTP instrumentation method Description Simple pure python utility for sniffing HTTP/HTTPS decrypted traffic recorded by one of...

CVE-2026-118682

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Description Context.Scheme unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted headers...