CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642

Traefik versions 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 are vulnerable to a TLS configuration bypass . The root cause is that the NTLM/Kerberos backend round tripper is stored in a client-connection slot not keyed by ServersTransport, causing one service's TLS configuration to be reused fo...

CVE-2026-114642

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backe...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - HTTP Response Desynchronization on Pooled Keep-Alive Sockets

HTTP Response Desynchronization on Pooled Keep-Alive Sockets vulnerability discovered by hasanfleyah in WordPress npm Node.js versions 22.23.4...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via free-socket reuse in the HTTP Agent. A remote HTTP peer can send response bytes that reach an idle keep-alive socket’s OS buffer before the event loop polls; the Agent may then reuse that socket and parse thos...

CVE-2026-48830

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

CVE-2026-48830

Apache bRPC versions through 1.17.0 are vulnerable to an improper authentication flaw (CWE-287 ). If ServerOptions.auth is enabled and builtin HTTP services are exposed, an unauthenticated remote attacker can send a builtin HTTP request as the first message on an HTTP/1.1 keep-alive connection. T...

EUVD-2026-107168

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

PT-2026-120527

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

dataops-testgen (>=3.7.1, <=4.1.3), keep-mirror (0.54.2) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.13.1)

snowflake-connector-python PYPI version 3.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dataops-testgen =3.7.1, =4.1.3 - keep-mirror 0.54.2 - rai-workflow-manager 0.0.52 Source cves: CVE-2026-865...

CVE-2026-94484 vulnerabilities

Vulnerabilities for packages: langfuse-fips, keep, zitadel, keep-fips...

CVE-2026-94543 vulnerabilities

Vulnerabilities for packages: langfuse-fips, keep, zitadel, keep-fips...

GHSA-4JQV-MC3X-M676 vulnerabilities

Vulnerabilities for packages: langfuse-fips, keep, zitadel, keep-fips...

GHSA-MCJ8-R9MP-W47P vulnerabilities

Vulnerabilities for packages: langfuse-fips, keep, zitadel, keep-fips...

[SECURITY] [DLA 4826-1] puma security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4826-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA October 07, 2026 https://wiki.debian.org/LTS -...

GHSA-68FV-2MGG-JV7Q vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, commercial-gitlab-rails-ee-fips, nextcloud-server, rancher-api-ui, langfuse, authentik-fips, jupyter-base-notebook, commercial-gitlab-rails-ee, homepage, keep-fips, unleash, semaphore, gitlab-rails-ce-fips, authentik, keep, gitlab-rails-ce,...

CVE-2026-93749 vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, commercial-gitlab-rails-ee-fips, nextcloud-server, rancher-api-ui, langfuse, authentik-fips, jupyter-base-notebook, commercial-gitlab-rails-ee, homepage, keep-fips, unleash, semaphore, gitlab-rails-ce-fips, authentik, keep, gitlab-rails-ce,...

K000163542: undici vulnerability CVE-2026-6733

Security Advisory Description Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the...