CLEANSTART-2026-AM95501 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11

Multiple security vulnerabilities affect the tomcat10 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability detail...

PT-2026-6499

Summary A Prototype Pollution vulnerability exists in the formToObj function within @builder.io/qwik-city middleware. The function processes form field names with dot notation e.g., user.name to create nested objects, but fails to sanitize dangerous property names like proto , constructor, and...

CLEANSTART-2026-SJ80413 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11

Multiple security vulnerabilities affect the tomcat9 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details...

CLEANSTART-2026-CD66042 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11

Multiple security vulnerabilities affect the tomcat9 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details...

CLEANSTART-2026-XP03839 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11

Multiple security vulnerabilities affect the tomcat9 package. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11. See references for individual vulnerability details...

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::getrootunchecked, which can cause undefined behavior UB by constructing arbitrary words or schemas. Reader::get rust pub fn get&self - Result::Reader // ... // UNSAFE: access words without validation...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005192)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005192 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in protounregister There's issue as follows: KASAN: maybe...

Malicious code in mw-proto-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a365899ad5e810104ab4af3dee30bf4bb6ba242dfe2bac8a8b6dce2ce4940dd8 The package mw-proto-models was found to contain malicious code. Source: ghsa-malware 1e2b22967998e78acece8a85fd589aaf543b7744c652af4973aeb8b5b67391a...

MAL-2026-368 Malicious code in mw-proto-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a365899ad5e810104ab4af3dee30bf4bb6ba242dfe2bac8a8b6dce2ce4940dd8 The package mw-proto-models was found to contain malicious code. Source: ghsa-malware 1e2b22967998e78acece8a85fd589aaf543b7744c652af4973aeb8b5b67391a...

EUVD-2026-3503

Malicious code in mw-proto-models npm...

Malicious Package

Overview mw-proto-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the bpf module, it was necessary to check whether the helper function is valid in gethelperproto. The kernel test robot reported a bug related to the verifier 1, where the helper function pointer could be NULL due to a disable...

CVE-2018-12916

In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in pbcPmessagedefault in proto.c...

CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate and merge functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential...

CVE-2022-42743

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...

RSEC-2025-1 Risk of __proto__ pollution Vulnerability

The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of proto being polluted in expandObjectPaths or nestedProperty...

OPENSUSE-SU-2025:20172-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50253: bpf: make sure skb-len != 0 when redirecting to a tunneling device bsc1249912. - CVE-2025-37916: pdscore: remove write-after-free of clientid bsc1243474. -...

CVE-2025-68227

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the skprot of sockets during protocol stack processing with sockmap's custom read/write...

CVE-2025-68227 mptcp: Fix proto fallback detection with BPF

In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the skprot of sockets during protocol stack processing with sockmap's custom read/write...

CVE-2025-68227

CVE-2025-68227 relates to the Linux kernel MPTCP path where sockmap/BPF can override sk_prot, causing improper protocol handling when a non-MPTCP TCP SYN is accepted. The fix makes comparison use sk_family (not sk_prot) to determine the protocol, preventing misclassification of sockets when sockm...